diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 2017-06-11 02:06:37 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 2017-06-11 02:06:37 +0000 |
| commit | 4424331b9432c43f46dad08149f7fd8fdf130c94 (patch) | |
| tree | bd62dfa6ea28a659ffffbb7d79ce5d561ac112b3 /sys/dev/ic | |
| parent | aa43d67dc1a03ac362f4a409af9a39ad07a6ba6c (diff) | |
integer overflow for two range checks
fix from C Turt, ok miod
Diffstat (limited to 'sys/dev/ic')
| -rw-r--r-- | sys/dev/ic/sti.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/dev/ic/sti.c b/sys/dev/ic/sti.c index f2a872ece20..8be71bcdfa2 100644 --- a/sys/dev/ic/sti.c +++ b/sys/dev/ic/sti.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sti.c,v 1.77 2015/09/09 18:23:39 deraadt Exp $ */ +/* $OpenBSD: sti.c,v 1.78 2017/06/11 02:06:36 deraadt Exp $ */ /* * Copyright (c) 2000-2003 Michael Shalayeff @@ -1130,7 +1130,7 @@ sti_ioctl(void *v, u_long cmd, caddr_t data, int flag, struct proc *p) cmapp = (struct wsdisplay_cmap *)data; idx = cmapp->index; count = cmapp->count; - if (idx >= STI_NCMAP || idx + count > STI_NCMAP) + if (idx >= STI_NCMAP || count > STI_NCMAP - idx) return EINVAL; if ((ret = copyout(&scr->scr_rcmap[idx], cmapp->red, count))) break; @@ -1146,7 +1146,7 @@ sti_ioctl(void *v, u_long cmd, caddr_t data, int flag, struct proc *p) cmapp = (struct wsdisplay_cmap *)data; idx = cmapp->index; count = cmapp->count; - if (idx >= STI_NCMAP || idx + count > STI_NCMAP) + if (idx >= STI_NCMAP || count > STI_NCMAP - idx) return EINVAL; if ((ret = copyin(cmapp->red, &scr->scr_rcmap[idx], count))) break; |