when mmap'ing check for offset >= size, not just > size and disallow negative offsets; mrg@netbsd.org

2 files changed, 6 insertions, 6 deletions

diff --git a/sys/arch/alpha/tc/cfb.c b/sys/arch/alpha/tc/cfb.c
index a59a77f225f..622aa607dc9 100644
--- a/sys/arch/alpha/tc/cfb.c
+++ b/sys/arch/alpha/tc/cfb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cfb.c,v 1.9 1997/11/06 12:27:05 niklas Exp $	*/
+/*	$OpenBSD: cfb.c,v 1.10 1998/11/21 18:13:03 millert Exp $	*/
 /*	$NetBSD: cfb.c,v 1.7 1996/12/05 01:39:39 cgd Exp $	*/
 
 /*
@@ -303,8 +303,8 @@ cfbmmap(v, offset, prot)
 {
 	struct cfb_softc *sc = v;
 
-	if (offset > CFB_SIZE)
-		return -1;
+	if (offset >= CFB_SIZE || offset < 0)
+		return (-1);
 	return alpha_btop(sc->sc_dc->dc_paddr + offset);
 }
 
diff --git a/sys/arch/alpha/tc/sfb.c b/sys/arch/alpha/tc/sfb.c
index f251bed5890..5bb7cabd239 100644
--- a/sys/arch/alpha/tc/sfb.c
+++ b/sys/arch/alpha/tc/sfb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sfb.c,v 1.9 1997/11/06 12:27:06 niklas Exp $	*/
+/*	$OpenBSD: sfb.c,v 1.10 1998/11/21 18:13:04 millert Exp $	*/
 /*	$NetBSD: sfb.c,v 1.7 1996/12/05 01:39:44 cgd Exp $	*/
 
 /*
@@ -348,8 +348,8 @@ sfbmmap(v, offset, prot)
 {
 	struct sfb_softc *sc = v;
 
-	if (offset > SFB_SIZE)
-		return -1;
+	if (offset >= SFB_SIZE || offset < 0)
+		return (-1);
 	return alpha_btop(sc->sc_dc->dc_paddr + offset);
 }