diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 2009-10-28 16:56:47 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 2009-10-28 16:56:47 +0000 |
| commit | 44a03bff38c353e73ecb643bb901b65f92c17539 (patch) | |
| tree | f9e875d233dcc83cd42190f38af9f21895040ae7 /sys/kern | |
| parent | cc105ae67622fa3604fd63976973cfe800bf75c1 (diff) | |
For the TIOCSET* ioctls, validate that the tty speeds are positive (since
they are signed int)
ok miod guenther
Diffstat (limited to 'sys/kern')
| -rw-r--r-- | sys/kern/tty.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/sys/kern/tty.c b/sys/kern/tty.c index 378a801f594..1d78066931a 100644 --- a/sys/kern/tty.c +++ b/sys/kern/tty.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tty.c,v 1.80 2009/07/19 08:16:06 blambert Exp $ */ +/* $OpenBSD: tty.c,v 1.81 2009/10/28 16:56:46 deraadt Exp $ */ /* $NetBSD: tty.c,v 1.68.4.2 1996/06/06 16:04:52 thorpej Exp $ */ /*- @@ -876,6 +876,13 @@ ttioctl(struct tty *tp, u_long cmd, caddr_t data, int flag, struct proc *p) } if (!ISSET(t->c_cflag, CIGNORE)) { /* + * Some minor validation is neccessary. + */ + if (t->c_ispeed < 0 || t->c_ospeed < 0) { + splx(s); + return (EINVAL); + } + /* * Set device hardware. */ if (tp->t_param && (error = (*tp->t_param)(tp, t))) { |