Fix checksum calculation:

1.  Iterate over all partitions counted in the label, which can be more
   than the number of partitions given to mkimg(1).
2.  Start the checksum from the beginning of the label; not the beginning
   of the bootarea.

Tested with bsdlabel(8).

Approved by:	re@ (rodrigc)

1 files changed, 7 insertions, 4 deletions

diff --git a/usr.bin/mkimg/bsd.c b/usr.bin/mkimg/bsd.c
index 03af5cd..a3ed63d 100644
--- a/usr.bin/mkimg/bsd.c
+++ b/usr.bin/mkimg/bsd.c
@@ -68,7 +68,7 @@ bsd_write(lba_t imgsz, void *bootcode)
 	struct disklabel *d;
 	struct partition *dp;
 	struct part *part;
-	int error, n;
+	int bsdparts, error, n;
 	uint16_t checksum;
 
 	buf = malloc(BBSIZE);
@@ -80,6 +80,9 @@ bsd_write(lba_t imgsz, void *bootcode)
 	} else
 		memset(buf, 0, BBSIZE);
 
+	bsdparts = nparts + 1;	/* Account for c partition */
+	if (bsdparts < MAXPARTITIONS)
+		bsdparts = MAXPARTITIONS;
 	imgsz = (lba_t)ncyls * nheads * nsecs;
 	error = image_set_size(imgsz);
 	if (error) {
@@ -97,7 +100,7 @@ bsd_write(lba_t imgsz, void *bootcode)
 	le32enc(&d->d_secperunit, imgsz);
 	le16enc(&d->d_rpm, 3600);
 	le32enc(&d->d_magic2, DISKMAGIC);
-	le16enc(&d->d_npartitions, (8 > nparts + 1) ? 8 : nparts + 1);
+	le16enc(&d->d_npartitions, bsdparts);
 	le32enc(&d->d_bbsize, BBSIZE);
 
 	dp = &d->d_partitions[RAW_PART];
@@ -110,9 +113,9 @@ bsd_write(lba_t imgsz, void *bootcode)
 		dp->p_fstype = ALIAS_TYPE2INT(part->type);
 	}
 
-	dp = &d->d_partitions[nparts + 1];
+	dp = &d->d_partitions[bsdparts];
 	checksum = 0;
-	for (p = buf; p < (u_char *)dp; p += 2)
+	for (p = (void *)d; p < (u_char *)dp; p += 2)
 		checksum ^= le16dec(p);
 	le16enc(&d->d_checksum, checksum);