diff options
| author | Todd C. Miller <millert@cvs.openbsd.org> | 2002-08-02 16:13:08 +0000 |
|---|---|---|
| committer | Todd C. Miller <millert@cvs.openbsd.org> | 2002-08-02 16:13:08 +0000 |
| commit | a725f7b84119cee1a43880f6fbe9ef73c1edc07a (patch) | |
| tree | 4ed3bcba829808c53ce5e5698482dc8e15668de7 /sys/dev/sbus | |
| parent | b0e6567fb529f695856bcc0d3526100ee6f1c5a0 (diff) | |
Do correct bounds checking in get/set/put cmap routines. A few of
these check were already OK but have been modified for consistency.
Problem found by Silvio Cesare.
Diffstat (limited to 'sys/dev/sbus')
| -rw-r--r-- | sys/dev/sbus/cgsix.c | 7 | ||||
| -rw-r--r-- | sys/dev/sbus/cgthree.c | 7 |
2 files changed, 6 insertions, 8 deletions
diff --git a/sys/dev/sbus/cgsix.c b/sys/dev/sbus/cgsix.c index fc9cba7cf8e..20f54ae0766 100644 --- a/sys/dev/sbus/cgsix.c +++ b/sys/dev/sbus/cgsix.c @@ -1,4 +1,4 @@ -/* $OpenBSD: cgsix.c,v 1.26 2002/07/30 23:03:30 jason Exp $ */ +/* $OpenBSD: cgsix.c,v 1.27 2002/08/02 16:13:07 millert Exp $ */ /* * Copyright (c) 2001 Jason L. Wright (jason@thought.net) @@ -506,7 +506,7 @@ cg6_bt_getcmap(bcm, rcm) u_int index = rcm->index, count = rcm->count, i; int error; - if (index >= 256 || index + count > 256) + if (index >= 256 || count > 256 - index) return (EINVAL); for (i = 0; i < count; i++) { if ((error = copyout(&bcm->cm_map[index + i][0], @@ -530,8 +530,7 @@ cg6_bt_putcmap(bcm, rcm) u_int index = rcm->index, count = rcm->count, i; int error; - if (index >= 256 || rcm->count > 256 || - (rcm->index + rcm->count) > 256) + if (index >= 256 || count > 256 - index) return (EINVAL); for (i = 0; i < count; i++) { if ((error = copyin(&rcm->red[i], diff --git a/sys/dev/sbus/cgthree.c b/sys/dev/sbus/cgthree.c index 781bc89ef52..a727217d455 100644 --- a/sys/dev/sbus/cgthree.c +++ b/sys/dev/sbus/cgthree.c @@ -1,4 +1,4 @@ -/* $OpenBSD: cgthree.c,v 1.20 2002/07/30 18:05:58 jason Exp $ */ +/* $OpenBSD: cgthree.c,v 1.21 2002/08/02 16:13:07 millert Exp $ */ /* * Copyright (c) 2001 Jason L. Wright (jason@thought.net) @@ -543,7 +543,7 @@ cg3_bt_getcmap(bcm, rcm) u_int index = rcm->index, count = rcm->count, i; int error; - if (index >= 256 || index + count > 256) + if (index >= 256 || count > 256 - index) return (EINVAL); for (i = 0; i < count; i++) { if ((error = copyout(&bcm->cm_map[index + i][0], @@ -567,8 +567,7 @@ cg3_bt_putcmap(bcm, rcm) u_int index = rcm->index, count = rcm->count, i; int error; - if (index >= 256 || rcm->count > 256 || - (rcm->index + rcm->count) > 256) + if (index >= 256 || count > 256 - index) return (EINVAL); for (i = 0; i < count; i++) { if ((error = copyin(&rcm->red[i], |