diff options
| author | nectar <nectar@FreeBSD.org> | 2004-04-03 15:28:25 +0000 |
|---|---|---|
| committer | nectar <nectar@FreeBSD.org> | 2004-04-03 15:28:25 +0000 |
| commit | 9c171c6f9c39cda65af3a7b6d06cf9d118db056b (patch) | |
| tree | 79fb05b06f3ff5e5543e0073063170a8fa341d8c /sys/dev/fb | |
| parent | 06eb91644cc48a24301dbb867bc95aa9f0515b44 (diff) | |
| download | FreeBSD-src-9c171c6f9c39cda65af3a7b6d06cf9d118db056b.zip FreeBSD-src-9c171c6f9c39cda65af3a7b6d06cf9d118db056b.tar.gz | |
Correct a potential panic condition that could be caused when getting or
setting the VGA palette.
Reported by: Christer Öberg <christer.oberg@texonet.com>
Reviewed by: bde
Diffstat (limited to 'sys/dev/fb')
| -rw-r--r-- | sys/dev/fb/vga.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/dev/fb/vga.c b/sys/dev/fb/vga.c index 461c207..7bde1d9 100644 --- a/sys/dev/fb/vga.c +++ b/sys/dev/fb/vga.c @@ -2854,7 +2854,8 @@ get_palette(video_adapter_t *adp, int base, int count, u_char *g; u_char *b; - if ((base < 0) || (base >= 256) || (base + count > 256)) + if (count < 0 || base < 0 || count > 256 || base > 256 || + base + count > 256) return EINVAL; r = malloc(count*3, M_DEVBUF, M_WAITOK); @@ -2885,7 +2886,8 @@ set_palette(video_adapter_t *adp, int base, int count, u_char *b; int err; - if ((base < 0) || (base >= 256) || (base + count > 256)) + if (count < 0 || base < 0 || count > 256 || base > 256 || + base + count > 256) return EINVAL; r = malloc(count*3, M_DEVBUF, M_WAITOK); |
