Permalink
Browse files

correct size checks so they cannot be circumvented by integer overflows

reported by CTurt, thanks for the notification
  • Loading branch information...
spzeidler committed Jun 13, 2017
1 parent 84612c1 commit 93cab5681678613efa55c056c589ab6c435f90ab
Showing with 18 additions and 14 deletions.
  1. +6 −2 sys/arch/ews4800mips/sbd/fb_sbdio.c
  2. +4 −4 sys/arch/pmax/ibus/pm.c
  3. +4 −4 sys/dev/hpc/bivideo.c
  4. +4 −4 sys/dev/ic/sti.c
@@ -1,4 +1,4 @@
/* $NetBSD: fb_sbdio.c,v 1.15 2015/06/23 21:00:23 matt Exp $ */
/* $NetBSD: fb_sbdio.c,v 1.16 2017/06/13 19:13:55 spz Exp $ */
/*-
* Copyright (c) 2004, 2005 The NetBSD Foundation, Inc.
@@ -32,7 +32,7 @@
#define WIRED_FB_TLB
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: fb_sbdio.c,v 1.15 2015/06/23 21:00:23 matt Exp $");
__KERNEL_RCSID(0, "$NetBSD: fb_sbdio.c,v 1.16 2017/06/13 19:13:55 spz Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -303,6 +303,8 @@ _fb_ioctl(void *v, void *vs, u_long cmd, void *data, int flag, struct lwp *l)
if (ri->ri_flg == RI_FORCEMONO)
break;
ga_clut_get(ga);
if (cmap->index >= 256 || cmap->count > 256 - cmap->index)
return (EINVAL);
for (i = 0; i < cmap->count; i++) {
cmap->red[i] = ga->clut[cmap->index + i][0];
cmap->green[i] = ga->clut[cmap->index + i][1];
@@ -313,6 +315,8 @@ _fb_ioctl(void *v, void *vs, u_long cmd, void *data, int flag, struct lwp *l)
case WSDISPLAYIO_PUTCMAP:
if (ri->ri_flg == RI_FORCEMONO)
break;
if (cmap->index >= 256 || cmap->count > 256 - cmap->index)
return (EINVAL);
for (i = 0; i < cmap->count; i++) {
ga->clut[cmap->index + i][0] = cmap->red[i];
ga->clut[cmap->index + i][1] = cmap->green[i];
View
@@ -1,4 +1,4 @@
/* $NetBSD: pm.c,v 1.12 2013/11/10 20:09:52 christos Exp $ */
/* $NetBSD: pm.c,v 1.13 2017/06/13 19:13:55 spz Exp $ */
/*-
* Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: pm.c,v 1.12 2013/11/10 20:09:52 christos Exp $");
__KERNEL_RCSID(0, "$NetBSD: pm.c,v 1.13 2017/06/13 19:13:55 spz Exp $");
#include <sys/param.h>
#include <sys/buf.h>
@@ -666,7 +666,7 @@ pm_get_cmap(struct pm_softc *sc, struct wsdisplay_cmap *p)
index = p->index;
count = p->count;
if (index >= sc->sc_cmap_size || (index + count) > sc->sc_cmap_size)
if (index >= sc->sc_cmap_size || count > sc->sc_cmap_size - index)
return (EINVAL);
if ((rv = copyout(&sc->sc_cmap.r[index], p->red, count)) != 0)
@@ -685,7 +685,7 @@ pm_set_cmap(struct pm_softc *sc, struct wsdisplay_cmap *p)
index = p->index;
count = p->count;
if (index >= sc->sc_cmap_size || (index + count) > sc->sc_cmap_size)
if (index >= sc->sc_cmap_size || count > sc->sc_cmap_size - index)
return (EINVAL);
if ((rv = copyin(p->red, &sc->sc_cmap.r[index], count)) != 0)
View
@@ -1,4 +1,4 @@
/* $NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $ */
/* $NetBSD: bivideo.c,v 1.34 2017/06/13 19:13:55 spz Exp $ */
/*-
* Copyright (c) 1999-2001
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $");
__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.34 2017/06/13 19:13:55 spz Exp $");
#ifdef _KERNEL_OPT
#include "opt_hpcfb.h"
@@ -402,8 +402,8 @@ bivideo_ioctl(void *v, u_long cmd, void *data, int flag, struct lwp *l)
if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR ||
sc->sc_fbconf.hf_pack_width != 8 ||
256 <= cmap->index ||
256 < (cmap->index + cmap->count))
cmap->index >= 256 ||
cmap->count > 256 - cmap->index)
return (EINVAL);
error = copyout(&bivideo_cmap_r[cmap->index], cmap->red,
View
@@ -1,4 +1,4 @@
/* $NetBSD: sti.c,v 1.18 2014/06/29 04:08:43 tsutsui Exp $ */
/* $NetBSD: sti.c,v 1.19 2017/06/13 19:13:55 spz Exp $ */
/* $OpenBSD: sti.c,v 1.61 2009/09/05 14:09:35 miod Exp $ */
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: sti.c,v 1.18 2014/06/29 04:08:43 tsutsui Exp $");
__KERNEL_RCSID(0, "$NetBSD: sti.c,v 1.19 2017/06/13 19:13:55 spz Exp $");
#include "wsdisplay.h"
@@ -1017,7 +1017,7 @@ sti_ioctl(void *v, void *vs, u_long cmd, void *data, int flag, struct lwp *l)
cmapp = (struct wsdisplay_cmap *)data;
idx = cmapp->index;
count = cmapp->count;
if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
if (idx >= STI_NCMAP || count > STI_NCMAP - idx)
return EINVAL;
if ((ret = copyout(&scr->scr_rcmap[idx], cmapp->red, count)))
break;
@@ -1033,7 +1033,7 @@ sti_ioctl(void *v, void *vs, u_long cmd, void *data, int flag, struct lwp *l)
cmapp = (struct wsdisplay_cmap *)data;
idx = cmapp->index;
count = cmapp->count;
if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
if (idx >= STI_NCMAP || count > STI_NCMAP - idx)
return EINVAL;
if ((ret = copyin(cmapp->red, &scr->scr_rcmap[idx], count)))
break;

0 comments on commit 93cab56

Please sign in to comment.