summaryrefslogtreecommitdiff
path: root/sys/dev
diff options
context:
space:
mode:
authorspz <spz@NetBSD.org>2017-06-13 19:13:55 +0000
committerspz <spz@NetBSD.org>2017-06-13 19:13:55 +0000
commitce53c60089f69e4c01e2e8bf3d9f554c41359852 (patch)
tree46f05eba78b5ffc8c4710d9b9537fac916ff44a5 /sys/dev
parentce61df0bc912dac5a21e76edb3b247c0e3f98969 (diff)
correct size checks so they cannot be circumvented by integer overflows
reported by CTurt, thanks for the notification
Diffstat (limited to 'sys/dev')
-rw-r--r--sys/dev/hpc/bivideo.c8
-rw-r--r--sys/dev/ic/sti.c8
2 files changed, 8 insertions, 8 deletions
diff --git a/sys/dev/hpc/bivideo.c b/sys/dev/hpc/bivideo.c
index c27cb1f3dd4..d76c0a9e38c 100644
--- a/sys/dev/hpc/bivideo.c
+++ b/sys/dev/hpc/bivideo.c
@@ -1,4 +1,4 @@
-/* $NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $ */
+/* $NetBSD: bivideo.c,v 1.34 2017/06/13 19:13:55 spz Exp $ */
/*-
* Copyright (c) 1999-2001
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.34 2017/06/13 19:13:55 spz Exp $");
#ifdef _KERNEL_OPT
#include "opt_hpcfb.h"
@@ -402,8 +402,8 @@ bivideo_ioctl(void *v, u_long cmd, void *data, int flag, struct lwp *l)
if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR ||
sc->sc_fbconf.hf_pack_width != 8 ||
- 256 <= cmap->index ||
- 256 < (cmap->index + cmap->count))
+ cmap->index >= 256 ||
+ cmap->count > 256 - cmap->index)
return (EINVAL);
error = copyout(&bivideo_cmap_r[cmap->index], cmap->red,
diff --git a/sys/dev/ic/sti.c b/sys/dev/ic/sti.c
index 85414329353..69bcd6245d5 100644
--- a/sys/dev/ic/sti.c
+++ b/sys/dev/ic/sti.c
@@ -1,4 +1,4 @@
-/* $NetBSD: sti.c,v 1.18 2014/06/29 04:08:43 tsutsui Exp $ */
+/* $NetBSD: sti.c,v 1.19 2017/06/13 19:13:55 spz Exp $ */
/* $OpenBSD: sti.c,v 1.61 2009/09/05 14:09:35 miod Exp $ */
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sti.c,v 1.18 2014/06/29 04:08:43 tsutsui Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sti.c,v 1.19 2017/06/13 19:13:55 spz Exp $");
#include "wsdisplay.h"
@@ -1017,7 +1017,7 @@ sti_ioctl(void *v, void *vs, u_long cmd, void *data, int flag, struct lwp *l)
cmapp = (struct wsdisplay_cmap *)data;
idx = cmapp->index;
count = cmapp->count;
- if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
+ if (idx >= STI_NCMAP || count > STI_NCMAP - idx)
return EINVAL;
if ((ret = copyout(&scr->scr_rcmap[idx], cmapp->red, count)))
break;
@@ -1033,7 +1033,7 @@ sti_ioctl(void *v, void *vs, u_long cmd, void *data, int flag, struct lwp *l)
cmapp = (struct wsdisplay_cmap *)data;
idx = cmapp->index;
count = cmapp->count;
- if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
+ if (idx >= STI_NCMAP || count > STI_NCMAP - idx)
return EINVAL;
if ((ret = copyin(cmapp->red, &scr->scr_rcmap[idx], count)))
break;