From a725f7b84119cee1a43880f6fbe9ef73c1edc07a Mon Sep 17 00:00:00 2001 From: "Todd C. Miller" Date: Fri, 2 Aug 2002 16:13:08 +0000 Subject: Do correct bounds checking in get/set/put cmap routines. A few of these check were already OK but have been modified for consistency. Problem found by Silvio Cesare. --- sys/arch/amiga/dev/view.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'sys/arch/amiga/dev/view.c') diff --git a/sys/arch/amiga/dev/view.c b/sys/arch/amiga/dev/view.c index c5d2e21c40d..7fe31dcdd32 100644 --- a/sys/arch/amiga/dev/view.c +++ b/sys/arch/amiga/dev/view.c @@ -1,4 +1,4 @@ -/* $OpenBSD: view.c,v 1.7 2002/06/11 03:25:43 miod Exp $ */ +/* $OpenBSD: view.c,v 1.8 2002/08/02 16:13:07 millert Exp $ */ /* $NetBSD: view.c,v 1.16 1996/10/13 03:07:35 christos Exp $ */ /* @@ -348,7 +348,10 @@ view_get_colormap (vu, ucm) u_long *uep; /* add one incase of zero, ick. */ - cme = malloc(sizeof (u_long)*(ucm->size + 1), M_IOCTLOPS, M_WAITOK); + if (ucm->size >= SIZE_T_MAX / sizeof(u_long)) + return (EINVAL); + cme = malloc(sizeof(u_long) * ((size_t)ucm->size + 1), M_IOCTLOPS, + M_WAITOK); uep = ucm->entry; error = 0; -- cgit v1.2.3