Instead of relying on uvm_useracc(), get a false sense of security, and

do not check copyin() result, take care and properly handle copyin() failure.

This was not harmful, but a bit more correctness never harms.

2 files changed, 22 insertions, 19 deletions

diff --git a/sys/arch/macppc/pci/vgafb.c b/sys/arch/macppc/pci/vgafb.c
index c1a9f67f63f..3f0b981784b 100644
--- a/sys/arch/macppc/pci/vgafb.c
+++ b/sys/arch/macppc/pci/vgafb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vgafb.c,v 1.19 2002/09/15 09:01:59 deraadt Exp $	*/
+/*	$OpenBSD: vgafb.c,v 1.20 2002/11/09 22:51:46 miod Exp $	*/
 /*	$NetBSD: vga.c,v 1.3 1996/12/02 22:24:54 cgd Exp $	*/
 
 /*
@@ -491,18 +491,19 @@ vgafb_putcmap(vc, cm)
 {
 	u_int index = cm->index;
 	u_int count = cm->count;
-	int i;
+	u_int i;
+	int error;
 	u_int8_t *r, *g, *b;
 
 	if (index >= 256 || count > 256 - index)
 		return EINVAL;
-	if (!uvm_useracc(cm->red, count, B_READ) ||
-	    !uvm_useracc(cm->green, count, B_READ) ||
-	    !uvm_useracc(cm->blue, count, B_READ))
-		return EFAULT;
-	copyin(cm->red,   &(vc->vc_cmap_red[index]),   count);
-	copyin(cm->green, &(vc->vc_cmap_green[index]), count);
-	copyin(cm->blue,  &(vc->vc_cmap_blue[index]),  count);
+
+	if ((error = copyin(cm->red, &vc->vc_cmap_red[index], count)) != 0)
+		return (error);
+	if ((error = copyin(cm->green, &vc->vc_cmap_green[index], count)) != 0)
+		return (error);
+	if ((error = copyin(cm->blue, &vc->vc_cmap_blue[index], count)) != 0)
+		return (error);
 
 	r = &(vc->vc_cmap_red[index]);
 	g = &(vc->vc_cmap_green[index]);
diff --git a/sys/arch/sparc64/dev/vgafb.c b/sys/arch/sparc64/dev/vgafb.c
index bb1627b7717..783c02c7b83 100644
--- a/sys/arch/sparc64/dev/vgafb.c
+++ b/sys/arch/sparc64/dev/vgafb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vgafb.c,v 1.28 2002/09/15 14:29:29 miod Exp $	*/
+/*	$OpenBSD: vgafb.c,v 1.29 2002/11/09 22:51:48 miod Exp $	*/
 
 /*
  * Copyright (c) 2001 Jason L. Wright (jason@thought.net)
@@ -357,25 +357,27 @@ vgafb_putcmap(sc, cm)
 {
 	u_int index = cm->index;
 	u_int count = cm->count;
-	int i;
+	u_int i;
+	int error;
 	u_char *r, *g, *b;
 
 	if (index >= 256 || count > 256 - index)
 		return (EINVAL);
-	if (!uvm_useracc(cm->red, cm->count, B_READ) ||
-	    !uvm_useracc(cm->green, cm->count, B_READ) ||
-	    !uvm_useracc(cm->blue, cm->count, B_READ))
-		return (EFAULT);
-	copyin(cm->red, &sc->sc_cmap_red[index], count);
-	copyin(cm->green, &sc->sc_cmap_green[index], count);
-	copyin(cm->blue, &sc->sc_cmap_blue[index], count);
+
+	if ((error = copyin(cm->red, &sc->sc_cmap_red[index], count)) != 0)
+		return (error);
+	if ((error = copyin(cm->green, &sc->sc_cmap_green[index], count)) != 0)
+		return (error);
+	if ((error = copyin(cm->blue, &sc->sc_cmap_blue[index], count)) != 0)
+		return (error);
 
 	r = &sc->sc_cmap_red[index];
 	g = &sc->sc_cmap_green[index];
 	b = &sc->sc_cmap_blue[index];
 
 	for (i = 0; i < count; i++) {
-		OF_call_method("color!", sc->sc_ofhandle, 4, 0, *r, *g, *b, index);
+		OF_call_method("color!", sc->sc_ofhandle, 4, 0, *r, *g, *b,
+		    index);
 		r++, g++, b++, index++;
 	}
 	return (0);