DosComLoader return DE_NOMEM would leak memory if it was useful

[ecm-pushbx]

This branch would leak the allocated environment and process memory blocks, if it was ever taken:

kernel/kernel/task.c

Line 544 in 5de2eb1

return DE_NOMEM;

I have not been able to get this to happen yet.

[ecm-pushbx]

During my attempts I did find a bug. Running these two executables causes an MCB corruption:

https://pushbx.org/ecm/test/20250123/t2025b.com

-u 100 l 10
2B03:0100 A12C00            mov     ax, [002C]
2B03:0103 48                dec     ax
2B03:0104 8EC0              mov     es, ax
2B03:0106 268B160300        mov     dx, [es:0003]
2B03:010B 83C212            add     dx, +12
2B03:010E 0E                push    cs
2B03:010F 07                pop     es
-u 140 l 2A
2B03:0140 B44A              mov     ah, 4A
2B03:0142 BBFFFF            mov     bx, FFFF
2B03:0145 CD21              int     21
2B03:0147 B44A              mov     ah, 4A
2B03:0149 29D3              sub     bx, dx
2B03:014B 90                nop
2B03:014C CD21              int     21
2B03:014E B8004B            mov     ax, 4B00
2B03:0151 BA0002            mov     dx, 0200
2B03:0154 BB0003            mov     bx, 0300
2B03:0157 8C4F04            mov     [bx+04], cs
2B03:015A 8C4F08            mov     [bx+08], cs
2B03:015D 8C4F0C            mov     [bx+0C], cs
2B03:0160 CD21              int     21
2B03:0162 90                nop
2B03:0163 CC                int3
2B03:0164 90                nop
2B03:0165 B8004C            mov     ax, 4C00
2B03:0168 CD21              int     21
-dz 200
int3.com
-dw 300 l E
header     0    2    4    6    8    A    C    E    0123456789ABCDEF
2B03:0300  0000 0080 0000 005C-0000 006C 0000      ......\...l...
-

The executable this runs is in https://pushbx.org/ecm/test/20250123/int3.com (int3, mov ax, 4C00h, int 21h)

Result:

E:\>t2025b
dos mem corrupt, first_mcb=02b4
prev 9fee:0000|4d ef 9f 10 00 20 2f 6e 49 4e 54 33 00 20 20 49 M∩ƒ.. /nINT3.  I
notMZ9fff:0000|cc b8 00 4c cd 21 00 00 53 43 00 00 00 00 00 00 ╠╕.L�!..SC......

PANIC: MCB chain corrupted
System halted

[ecm-pushbx]

cc b8 00 4c cd 21 is the contents of int3.com of course. Apparently the kernel allocated a memory block of size 16 (10h) paragraphs at 9FEFh and read the executable's contents to 9FEFh:0100h despite that being beyond the end of the block.

[boeckmann]

kernel/kernel/task.c

Line 459 in 5de2eb1

com_size = ((UWORD)min(com_size_long, 0xfe00u) >> 4) + 0x10;

I assume the + 0x10 is for 16 paragraphs of PSP (256 bytes)? Then I think this line is missing a + 15 after com_size_long, as it gets divided by 16, so rounded DOWN?

[boeckmann]

Also, when the maximum value is fe00, then there should also be added an 0x10 for the stack? otherwise the maximum could be ff00?

[ecm-pushbx]

Referenced in #207 (comment)

[ecm-pushbx]

I did recall that either you or me had mentioned this before but didn't find it in the bug list. But this here is a discussion, not bug report. Albeit it probably should be.