diff options
| author | Mark Kettenis <kettenis@cvs.openbsd.org> | 2020-05-10 20:50:56 +0000 |
|---|---|---|
| committer | Mark Kettenis <kettenis@cvs.openbsd.org> | 2020-05-10 20:50:56 +0000 |
| commit | 230caa5cee2cbe312b7ca3faf0ca7f1f34b3d7d1 (patch) | |
| tree | 036024aaca712449f91956f2f85670254d96a7b9 /sys/dev/wscons | |
| parent | aa1c5762db8017c4ae4e23a1d0155f6def746cae (diff) | |
Fix two out-of-bounds array accesses in ioctl code pats. One found by
johnc@armadilloaerospace.com and another one spotted by matthieu@.
ok benno@, matthieu@, deraadt@
Diffstat (limited to 'sys/dev/wscons')
| -rw-r--r-- | sys/dev/wscons/wsdisplay.c | 4 | ||||
| -rw-r--r-- | sys/dev/wscons/wsemulconf.c | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/sys/dev/wscons/wsdisplay.c b/sys/dev/wscons/wsdisplay.c index 75edf7ba303..7433d3a0ff4 100644 --- a/sys/dev/wscons/wsdisplay.c +++ b/sys/dev/wscons/wsdisplay.c @@ -1,4 +1,4 @@ -/* $OpenBSD: wsdisplay.c,v 1.138 2020/04/26 11:31:07 bru Exp $ */ +/* $OpenBSD: wsdisplay.c,v 1.139 2020/05/10 20:50:55 kettenis Exp $ */ /* $NetBSD: wsdisplay.c,v 1.82 2005/02/27 00:27:52 perry Exp $ */ /* @@ -1261,7 +1261,7 @@ wsdisplay_internal_ioctl(struct wsdisplay_softc *sc, struct wsscreen *scr, case WSDISPLAYIO_GETSCREENTYPE: #define d ((struct wsdisplay_screentype *)data) - if (d->idx >= sc->sc_scrdata->nscreens) + if (d->idx < 0 || d->idx >= sc->sc_scrdata->nscreens) return(EINVAL); d->nidx = sc->sc_scrdata->nscreens; diff --git a/sys/dev/wscons/wsemulconf.c b/sys/dev/wscons/wsemulconf.c index bab5be014e2..19545fa1dc7 100644 --- a/sys/dev/wscons/wsemulconf.c +++ b/sys/dev/wscons/wsemulconf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: wsemulconf.c,v 1.9 2015/03/14 03:38:50 jsg Exp $ */ +/* $OpenBSD: wsemulconf.c,v 1.10 2020/05/10 20:50:55 kettenis Exp $ */ /* $NetBSD: wsemulconf.c,v 1.4 2000/01/05 11:19:37 drochner Exp $ */ /* @@ -78,7 +78,7 @@ wsemul_pick(const char *name) const char * wsemul_getname(int idx) { - if (idx >= nitems(wsemul_conf) - 1) + if (idx < 0 || idx >= nitems(wsemul_conf) - 1) return (NULL); return (wsemul_conf[idx]->name); } |