diff options
| author | anton <anton@cvs.openbsd.org> | 2019-01-27 11:59:31 +0000 |
|---|---|---|
| committer | anton <anton@cvs.openbsd.org> | 2019-01-27 11:59:31 +0000 |
| commit | 4a2a318b51becfba0dbcbd8f926bc0511e3b4b05 (patch) | |
| tree | 3f9fe6a73fbd94e70836172dd481ae21f9986fff /sys | |
| parent | 5b520f0f59f11916239842abfd0e989cf63e8248 (diff) | |
Validate the user-supplied device index given to WSMUXIO_ADD_DEVICE. The same
index is used to index an array which could cause a panic if it's negative.
ok deraadt@
Reported-by: syzbot+c5997876fea393e6b948@syzkaller.appspotmail.com
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/wscons/wsmux.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/dev/wscons/wsmux.c b/sys/dev/wscons/wsmux.c index f92cf46d38d..dd2b3cb6aab 100644 --- a/sys/dev/wscons/wsmux.c +++ b/sys/dev/wscons/wsmux.c @@ -1,4 +1,4 @@ -/* $OpenBSD: wsmux.c,v 1.36 2018/12/17 19:14:59 anton Exp $ */ +/* $OpenBSD: wsmux.c,v 1.37 2019/01/27 11:59:30 anton Exp $ */ /* $NetBSD: wsmux.c,v 1.37 2005/04/30 03:47:12 augustss Exp $ */ /* @@ -411,6 +411,8 @@ wsmux_do_ioctl(struct device *dv, u_long cmd, caddr_t data, int flag, #define d ((struct wsmux_device *)data) DPRINTF(("%s: add type=%d, no=%d\n", sc->sc_base.me_dv.dv_xname, d->type, d->idx)); + if (d->idx < 0) + return (EINVAL); switch (d->type) { #if NWSMOUSE > 0 case WSMUX_MOUSE: |