summaryrefslogtreecommitdiff
path: root/sys/dev/hpc
diff options
context:
space:
mode:
authorspz <spz@NetBSD.org>2017-06-13 19:13:55 +0000
committerspz <spz@NetBSD.org>2017-06-13 19:13:55 +0000
commitce53c60089f69e4c01e2e8bf3d9f554c41359852 (patch)
tree46f05eba78b5ffc8c4710d9b9537fac916ff44a5 /sys/dev/hpc
parentce61df0bc912dac5a21e76edb3b247c0e3f98969 (diff)
correct size checks so they cannot be circumvented by integer overflows
reported by CTurt, thanks for the notification
Diffstat (limited to 'sys/dev/hpc')
-rw-r--r--sys/dev/hpc/bivideo.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/dev/hpc/bivideo.c b/sys/dev/hpc/bivideo.c
index c27cb1f3dd4..d76c0a9e38c 100644
--- a/sys/dev/hpc/bivideo.c
+++ b/sys/dev/hpc/bivideo.c
@@ -1,4 +1,4 @@
-/* $NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $ */
+/* $NetBSD: bivideo.c,v 1.34 2017/06/13 19:13:55 spz Exp $ */
/*-
* Copyright (c) 1999-2001
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.34 2017/06/13 19:13:55 spz Exp $");
#ifdef _KERNEL_OPT
#include "opt_hpcfb.h"
@@ -402,8 +402,8 @@ bivideo_ioctl(void *v, u_long cmd, void *data, int flag, struct lwp *l)
if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR ||
sc->sc_fbconf.hf_pack_width != 8 ||
- 256 <= cmap->index ||
- 256 < (cmap->index + cmap->count))
+ cmap->index >= 256 ||
+ cmap->count > 256 - cmap->index)
return (EINVAL);
error = copyout(&bivideo_cmap_r[cmap->index], cmap->red,