diff options
| author | sos <sos@FreeBSD.org> | 1994-04-26 09:09:57 +0000 |
|---|---|---|
| committer | sos <sos@FreeBSD.org> | 1994-04-26 09:09:57 +0000 |
| commit | 90387385b15bcf9cf356fe844af5f69e4b22f412 (patch) | |
| tree | c5e68685ad84e3568287827406b1282387278553 /sys/dev | |
| parent | bac3b7fca5322738bda4ead89c3871c594baeda7 (diff) | |
| download | FreeBSD-src-90387385b15bcf9cf356fe844af5f69e4b22f412.zip FreeBSD-src-90387385b15bcf9cf356fe844af5f69e4b22f412.tar.gz | |
Fixed missing bounds check in scroll up/down sequence, that could
cause a panic (and did).
Diffstat (limited to 'sys/dev')
| -rw-r--r-- | sys/dev/syscons/syscons.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/sys/dev/syscons/syscons.c b/sys/dev/syscons/syscons.c index 5ad55ea..8757295 100644 --- a/sys/dev/syscons/syscons.c +++ b/sys/dev/syscons/syscons.c @@ -35,7 +35,7 @@ * SUCH DAMAGE. * * from:@(#)syscons.c 1.3 940129 - * $Id: syscons.c,v 1.43 1994/04/12 00:05:23 ache Exp $ + * $Id: syscons.c,v 1.44 1994/04/21 14:22:26 sos Exp $ * */ @@ -849,11 +849,11 @@ int pcioctl(dev_t dev, int cmd, caddr_t data, int flag, struct proc *p) outb(TIMER_CNTR2, pitch); outb(TIMER_CNTR2, (pitch>>8)); /* enable counter 2 output to speaker */ - outb(0x61, inb(0x61) | 3); + outb(IO_PPI, inb(IO_PPI) | 3); } else { /* disable counter 2 output to speaker */ - outb(0x61, inb(0x61) & 0xFC); + outb(IO_PPI, inb(IO_PPI) & 0xFC); release_timer2(); } } @@ -1692,6 +1692,8 @@ static void scan_esc(scr_stat *scp, u_char c) case 'S': /* scroll up n lines */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->ypos) + n = scp->ypos; bcopy(scp->crt_base + (scp->xsize * n), scp->crt_base, scp->xsize * (scp->ysize - n) * @@ -1704,16 +1706,20 @@ static void scan_esc(scr_stat *scp, u_char c) case 'T': /* scroll down n lines */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->ysize - scp->ypos) + n = scp->ysize - scp->ypos; bcopy(scp->crt_base, scp->crt_base + (scp->xsize * n), scp->xsize * (scp->ysize - n) * sizeof(u_short)); - fillw(scp->term.cur_attr | scr_map[0x20], scp->crt_base, - scp->xsize); + fillw(scp->term.cur_attr | scr_map[0x20], + scp->crt_base, scp->xsize); break; case 'X': /* delete n characters in line */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->xsize - scp->xpos) + n = scp->xsize - scp->xpos; fillw(scp->term.cur_attr | scr_map[0x20], scp->crt_base + scp->xpos + ((scp->xsize*scp->ypos) * sizeof(u_short)), n); |
