Instead of relying on uvm_useracc(), get a false sense of security, and

do not check copyin() result, take care and properly handle copyin() failure.

This was not harmful, but a bit more correctness never harms.

1 files changed, 10 insertions, 9 deletions

diff --git a/sys/arch/macppc/pci/vgafb.c b/sys/arch/macppc/pci/vgafb.c
index c1a9f67f63f..3f0b981784b 100644
--- a/sys/arch/macppc/pci/vgafb.c
+++ b/sys/arch/macppc/pci/vgafb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vgafb.c,v 1.19 2002/09/15 09:01:59 deraadt Exp $	*/
+/*	$OpenBSD: vgafb.c,v 1.20 2002/11/09 22:51:46 miod Exp $	*/
 /*	$NetBSD: vga.c,v 1.3 1996/12/02 22:24:54 cgd Exp $	*/
 
 /*
@@ -491,18 +491,19 @@ vgafb_putcmap(vc, cm)
 {
 	u_int index = cm->index;
 	u_int count = cm->count;
-	int i;
+	u_int i;
+	int error;
 	u_int8_t *r, *g, *b;
 
 	if (index >= 256 || count > 256 - index)
 		return EINVAL;
-	if (!uvm_useracc(cm->red, count, B_READ) ||
-	    !uvm_useracc(cm->green, count, B_READ) ||
-	    !uvm_useracc(cm->blue, count, B_READ))
-		return EFAULT;
-	copyin(cm->red,   &(vc->vc_cmap_red[index]),   count);
-	copyin(cm->green, &(vc->vc_cmap_green[index]), count);
-	copyin(cm->blue,  &(vc->vc_cmap_blue[index]),  count);
+
+	if ((error = copyin(cm->red, &vc->vc_cmap_red[index], count)) != 0)
+		return (error);
+	if ((error = copyin(cm->green, &vc->vc_cmap_green[index], count)) != 0)
+		return (error);
+	if ((error = copyin(cm->blue, &vc->vc_cmap_blue[index], count)) != 0)
+		return (error);
 
 	r = &(vc->vc_cmap_red[index]);
 	g = &(vc->vc_cmap_green[index]);