diff options
| author | Todd C. Miller <millert@cvs.openbsd.org> | 2002-08-02 16:13:08 +0000 |
|---|---|---|
| committer | Todd C. Miller <millert@cvs.openbsd.org> | 2002-08-02 16:13:08 +0000 |
| commit | a725f7b84119cee1a43880f6fbe9ef73c1edc07a (patch) | |
| tree | 4ed3bcba829808c53ce5e5698482dc8e15668de7 /sys/arch/sparc/dev | |
| parent | b0e6567fb529f695856bcc0d3526100ee6f1c5a0 (diff) | |
Do correct bounds checking in get/set/put cmap routines. A few of
these check were already OK but have been modified for consistency.
Problem found by Silvio Cesare.
Diffstat (limited to 'sys/arch/sparc/dev')
| -rw-r--r-- | sys/arch/sparc/dev/bt_subr.c | 6 | ||||
| -rw-r--r-- | sys/arch/sparc/dev/cgfourteen.c | 14 | ||||
| -rw-r--r-- | sys/arch/sparc/dev/cgtwo.c | 6 |
3 files changed, 13 insertions, 13 deletions
diff --git a/sys/arch/sparc/dev/bt_subr.c b/sys/arch/sparc/dev/bt_subr.c index 9a24467081b..224de260bfa 100644 --- a/sys/arch/sparc/dev/bt_subr.c +++ b/sys/arch/sparc/dev/bt_subr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: bt_subr.c,v 1.6 2001/11/06 19:53:16 miod Exp $ */ +/* $OpenBSD: bt_subr.c,v 1.7 2002/08/02 16:13:07 millert Exp $ */ /* $NetBSD: bt_subr.c,v 1.5 1996/03/14 19:44:32 christos Exp $ */ /* @@ -77,7 +77,7 @@ bt_getcmap(p, cm, cmsize) start = p->index; count = p->count; - if (start >= cmsize || start + count > cmsize) + if (start >= cmsize || count > cmsize - start) return (EINVAL); if (!uvm_useracc(p->red, count, B_WRITE) || !uvm_useracc(p->green, count, B_WRITE) || @@ -105,7 +105,7 @@ bt_putcmap(p, cm, cmsize) start = p->index; count = p->count; - if (start >= cmsize || start + count > cmsize) + if (start >= cmsize || count > cmsize - start) return (EINVAL); if (!uvm_useracc(p->red, count, B_READ) || !uvm_useracc(p->green, count, B_READ) || diff --git a/sys/arch/sparc/dev/cgfourteen.c b/sys/arch/sparc/dev/cgfourteen.c index 9c4c0719a4f..372df567452 100644 --- a/sys/arch/sparc/dev/cgfourteen.c +++ b/sys/arch/sparc/dev/cgfourteen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: cgfourteen.c,v 1.9 2002/03/14 01:26:42 millert Exp $ */ +/* $OpenBSD: cgfourteen.c,v 1.10 2002/08/02 16:13:07 millert Exp $ */ /* $NetBSD: cgfourteen.c,v 1.7 1997/05/24 20:16:08 pk Exp $ */ /* @@ -748,11 +748,11 @@ cg14_get_cmap(p, cm, cmsize) start = p->index; count = p->count; - if (start >= cmsize || start + count > cmsize) + if (start >= cmsize || count > cmsize - start) #ifdef DEBUG { - printf("putcmaperror: start %d cmsize %d count %d\n", - start,cmsize,count); + printf("putcmaperror: start %u cmsize %d count %u\n", + start, cmsize, count); #endif return (EINVAL); #ifdef DEBUG @@ -783,11 +783,11 @@ cg14_put_cmap(p, cm, cmsize) start = p->index; count = p->count; - if (start >= cmsize || start + count > cmsize) + if (start >= cmsize || count > cmsize - start) #ifdef DEBUG { - printf("putcmaperror: start %d cmsize %d count %d\n", - start,cmsize,count); + printf("putcmaperror: start %u cmsize %d count %u\n", + start, cmsize, count); #endif return (EINVAL); #ifdef DEBUG diff --git a/sys/arch/sparc/dev/cgtwo.c b/sys/arch/sparc/dev/cgtwo.c index 4f3b8d44627..2204e78e2db 100644 --- a/sys/arch/sparc/dev/cgtwo.c +++ b/sys/arch/sparc/dev/cgtwo.c @@ -1,4 +1,4 @@ -/* $OpenBSD: cgtwo.c,v 1.20 2002/03/14 03:15:59 millert Exp $ */ +/* $OpenBSD: cgtwo.c,v 1.21 2002/08/02 16:13:07 millert Exp $ */ /* $NetBSD: cgtwo.c,v 1.22 1997/05/24 20:16:12 pk Exp $ */ /* @@ -341,7 +341,7 @@ cgtwogetcmap(sc, cmap) start = cmap->index; count = cmap->count; ecount = start + count; - if (start >= CG2_CMSIZE || ecount > CG2_CMSIZE) + if (start >= CG2_CMSIZE || count > CG2_CMSIZE - start) return (EINVAL); /* XXX - Wait for retrace? */ @@ -384,7 +384,7 @@ cgtwoputcmap(sc, cmap) start = cmap->index; count = cmap->count; ecount = start + count; - if (start >= CG2_CMSIZE || ecount > CG2_CMSIZE) + if (start >= CG2_CMSIZE || count > CG2_CMSIZE - start) return (EINVAL); /* Copy from user space to local arrays. */ |