limit the number of fonts that can be loaded

ok millert mlarkin deraadt

2 files changed, 12 insertions, 3 deletions

diff --git a/sys/dev/wscons/wsconsio.h b/sys/dev/wscons/wsconsio.h
index 32d2eef6962..5eb555f238b 100644
--- a/sys/dev/wscons/wsconsio.h
+++ b/sys/dev/wscons/wsconsio.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsconsio.h,v 1.74 2016/03/30 23:34:12 bru Exp $ */
+/* $OpenBSD: wsconsio.h,v 1.75 2016/09/14 03:25:51 jcs Exp $ */
 /* $NetBSD: wsconsio.h,v 1.74 2005/04/28 07:15:44 martin Exp $ */
 
 /*
@@ -418,6 +418,7 @@ struct wsdisplay_cursor {
 struct wsdisplay_font {
 	char name[WSFONT_NAME_SIZE];
 	int index;
+#define WSDISPLAY_MAXFONTCOUNT	8
 	int firstchar, numchars;
 	int encoding;
 #define WSDISPLAY_FONTENC_ISO 0
diff --git a/sys/dev/wsfont/wsfont.c b/sys/dev/wsfont/wsfont.c
index b6fda1c745d..f55c2a388a7 100644
--- a/sys/dev/wsfont/wsfont.c
+++ b/sys/dev/wsfont/wsfont.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wsfont.c,v 1.43 2016/09/04 18:20:34 tedu Exp $ */
+/*	$OpenBSD: wsfont.c,v 1.44 2016/09/14 03:25:51 jcs Exp $ */
 /*	$NetBSD: wsfont.c,v 1.17 2001/02/07 13:59:24 ad Exp $	*/
 
 /*-
@@ -450,7 +450,7 @@ wsfont_add(struct wsdisplay_font *font, int copy)
 {
 	static int cookiegen = 666;
 	struct font *ent;
-	int s;
+	int s, fontc = 0;
 
 	s = splhigh();
 
@@ -461,6 +461,14 @@ wsfont_add(struct wsdisplay_font *font, int copy)
 		return (-1);
 	}
 
+	TAILQ_FOREACH(ent, &fontlist, chain)
+		fontc++;
+
+	if (fontc >= WSDISPLAY_MAXFONTCOUNT) {
+		splx(s);
+		return (-1);
+	}
+
 	ent = (struct font *)malloc(sizeof *ent, M_DEVBUF, M_WAITOK);
 
 	ent->lockcount = 0;