diff options
| author | spz <spz@NetBSD.org> | 2017-06-13 19:13:55 +0000 |
|---|---|---|
| committer | spz <spz@NetBSD.org> | 2017-06-13 19:13:55 +0000 |
| commit | ce53c60089f69e4c01e2e8bf3d9f554c41359852 (patch) | |
| tree | 46f05eba78b5ffc8c4710d9b9537fac916ff44a5 /sys/dev/hpc | |
| parent | ce61df0bc912dac5a21e76edb3b247c0e3f98969 (diff) | |
correct size checks so they cannot be circumvented by integer overflows
reported by CTurt, thanks for the notification
Diffstat (limited to 'sys/dev/hpc')
| -rw-r--r-- | sys/dev/hpc/bivideo.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/dev/hpc/bivideo.c b/sys/dev/hpc/bivideo.c index c27cb1f3dd4..d76c0a9e38c 100644 --- a/sys/dev/hpc/bivideo.c +++ b/sys/dev/hpc/bivideo.c @@ -1,4 +1,4 @@ -/* $NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $ */ +/* $NetBSD: bivideo.c,v 1.34 2017/06/13 19:13:55 spz Exp $ */ /*- * Copyright (c) 1999-2001 @@ -35,7 +35,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $"); +__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.34 2017/06/13 19:13:55 spz Exp $"); #ifdef _KERNEL_OPT #include "opt_hpcfb.h" @@ -402,8 +402,8 @@ bivideo_ioctl(void *v, u_long cmd, void *data, int flag, struct lwp *l) if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR || sc->sc_fbconf.hf_pack_width != 8 || - 256 <= cmap->index || - 256 < (cmap->index + cmap->count)) + cmap->index >= 256 || + cmap->count > 256 - cmap->index) return (EINVAL); error = copyout(&bivideo_cmap_r[cmap->index], cmap->red, |
