From 230caa5cee2cbe312b7ca3faf0ca7f1f34b3d7d1 Mon Sep 17 00:00:00 2001
From: Mark Kettenis <kettenis@cvs.openbsd.org>
Date: Sun, 10 May 2020 20:50:56 +0000
Subject: Fix two out-of-bounds array accesses in ioctl code pats.  One found
 by johnc@armadilloaerospace.com and another one spotted by matthieu@.

ok benno@, matthieu@, deraadt@
---
 sys/dev/wscons/wsdisplay.c  | 4 ++--
 sys/dev/wscons/wsemulconf.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'sys/dev/wscons')

diff --git a/sys/dev/wscons/wsdisplay.c b/sys/dev/wscons/wsdisplay.c
index 75edf7ba303..7433d3a0ff4 100644
--- a/sys/dev/wscons/wsdisplay.c
+++ b/sys/dev/wscons/wsdisplay.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsdisplay.c,v 1.138 2020/04/26 11:31:07 bru Exp $ */
+/* $OpenBSD: wsdisplay.c,v 1.139 2020/05/10 20:50:55 kettenis Exp $ */
 /* $NetBSD: wsdisplay.c,v 1.82 2005/02/27 00:27:52 perry Exp $ */
 
 /*
@@ -1261,7 +1261,7 @@ wsdisplay_internal_ioctl(struct wsdisplay_softc *sc, struct wsscreen *scr,
 
 	case WSDISPLAYIO_GETSCREENTYPE:
 #define d ((struct wsdisplay_screentype *)data)
-		if (d->idx >= sc->sc_scrdata->nscreens)
+		if (d->idx < 0 || d->idx >= sc->sc_scrdata->nscreens)
 			return(EINVAL);
 
 		d->nidx = sc->sc_scrdata->nscreens;
diff --git a/sys/dev/wscons/wsemulconf.c b/sys/dev/wscons/wsemulconf.c
index bab5be014e2..19545fa1dc7 100644
--- a/sys/dev/wscons/wsemulconf.c
+++ b/sys/dev/wscons/wsemulconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsemulconf.c,v 1.9 2015/03/14 03:38:50 jsg Exp $ */
+/* $OpenBSD: wsemulconf.c,v 1.10 2020/05/10 20:50:55 kettenis Exp $ */
 /* $NetBSD: wsemulconf.c,v 1.4 2000/01/05 11:19:37 drochner Exp $ */
 
 /*
@@ -78,7 +78,7 @@ wsemul_pick(const char *name)
 const char *
 wsemul_getname(int idx)
 {
-	if (idx >= nitems(wsemul_conf) - 1)
+	if (idx < 0 || idx >= nitems(wsemul_conf) - 1)
 		return (NULL);
 	return (wsemul_conf[idx]->name);
 }
-- 
cgit v1.2.3