Check for valid speed values in pty drive

Check for negative speed values in tty drive
Back out valid speed values checking from tty drive
Suggested by: bde

3 files changed, 38 insertions, 28 deletions

diff --git a/sys/kern/tty.c b/sys/kern/tty.c
index dc5fe3f..e8c111d 100644
--- a/sys/kern/tty.c
+++ b/sys/kern/tty.c
@@ -36,7 +36,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)tty.c	8.8 (Berkeley) 1/21/94
- * $Id: tty.c,v 1.67 1995/08/01 23:27:34 ache Exp $
+ * $Id: tty.c,v 1.68 1995/08/01 23:38:00 ache Exp $
  */
 
 /*-
@@ -175,12 +175,6 @@ char const char_type[] = {
 #undef	TB
 #undef	VT
 
-int validspeed[] = {
-	0, 50, 75, 110, 134, 150, 200, 300, 600, 1200,
-	1800, 2400, 4800, 9600, 19200, 38400, 57600, 115200
-};
-#define MAX_SPEED (sizeof(validspeed)/sizeof(*validspeed) - 1)
-
 /* Macros to clear/set/test flags. */
 #define	SET(t, f)	(t) |= (f)
 #define	CLR(t, f)	(t) &= ~(f)
@@ -829,23 +823,9 @@ ttioctl(tp, cmd, data, flag)
 	case TIOCSETAW:			/* drain output, set */
 	case TIOCSETAF: {		/* drn out, fls in, set */
 		register struct termios *t = (struct termios *)data;
-		register int i;
 
-		for (i = MAX_SPEED; i >= 0; i--)
-			if (t->c_ispeed == validspeed[i])
-				break;
-			else if (t->c_ispeed > validspeed[i])
-				return (EINVAL);
-		if (i < 0)
+		if (t->c_ispeed < 0 || t->c_ospeed < 0)
 			return (EINVAL);
-		for (i = MAX_SPEED; i >= 0; i--)
-			if (t->c_ospeed == validspeed[i])
-				break;
-			else if (t->c_ospeed > validspeed[i])
-				return (EINVAL);
-		if (i < 0)
-			return (EINVAL);
-
 		s = spltty();
 		if (cmd == TIOCSETAW || cmd == TIOCSETAF) {
 			error = ttywait(tp);
diff --git a/sys/kern/tty_compat.c b/sys/kern/tty_compat.c
index 628b11c..26ed1ec 100644
--- a/sys/kern/tty_compat.c
+++ b/sys/kern/tty_compat.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)tty_compat.c	8.1 (Berkeley) 6/10/93
- * $Id: tty_compat.c,v 1.13 1995/05/30 08:06:09 rgrimes Exp $
+ * $Id: tty_compat.c,v 1.14 1995/08/01 23:27:36 ache Exp $
  */
 
 /*
@@ -78,7 +78,10 @@ static struct speedtab compatspeeds[] = {
 	{ 0,	0 },
 	{ -1,	-1 },
 };
-extern int validspeed[];     /* in tty.c */
+static int compatspcodes[] = {
+	0, 50, 75, 110, 134, 150, 200, 300, 600, 1200,
+	1800, 2400, 4800, 9600, 19200, 38400, 57600, 115200,
+};
 
 int ttsetcompat(tp, com, data, term)
 	register struct tty *tp;
@@ -95,11 +98,11 @@ int ttsetcompat(tp, com, data, term)
 		if ((speed = sg->sg_ispeed) > MAX_SPEED || speed < 0)
 			return(EINVAL);
 		else
-			term->c_ispeed = validspeed[speed];
+			term->c_ispeed = compatspcodes[speed];
 		if ((speed = sg->sg_ospeed) > MAX_SPEED || speed < 0)
 			return(EINVAL);
 		else
-			term->c_ospeed = validspeed[speed];
+			term->c_ospeed = compatspcodes[speed];
 		term->c_cc[VERASE] = sg->sg_erase;
 		term->c_cc[VKILL] = sg->sg_kill;
 		tp->t_flags = (tp->t_flags&0xffff0000) | (sg->sg_flags&0xffff);
diff --git a/sys/kern/tty_pty.c b/sys/kern/tty_pty.c
index 9bbb003..4578d11 100644
--- a/sys/kern/tty_pty.c
+++ b/sys/kern/tty_pty.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)tty_pty.c	8.2 (Berkeley) 9/23/93
- * $Id: tty_pty.c,v 1.16 1995/07/31 21:01:25 bde Exp $
+ * $Id: tty_pty.c,v 1.17 1995/08/02 02:55:47 bde Exp $
  */
 
 /*
@@ -71,6 +71,11 @@ struct	pt_ioctl {
 	u_char	pt_ucntl;
 } pt_ioctl[NPTY];		/* XXX */
 int	npty = NPTY;		/* for pstat -t */
+static int validspeed[] = {
+	0, 50, 75, 110, 134, 150, 200, 300, 600, 1200,
+	1800, 2400, 4800, 9600, 19200, 38400, 57600, 115200
+};
+#define MAX_SPEED (sizeof(validspeed)/sizeof(*validspeed) - 1)
 
 #define	PF_PKT		0x08		/* packet mode */
 #define	PF_STOPPED	0x10		/* user told stopped */
@@ -644,10 +649,32 @@ ptyioctl(dev, cmd, data, flag, p)
 		case TIOCSETN:
 #endif
 		case TIOCSETD:
+			ndflush(&tp->t_outq, tp->t_outq.c_cc);
+			break;
+
 		case TIOCSETA:
 		case TIOCSETAW:
-		case TIOCSETAF:
+		case TIOCSETAF: {
+			register struct termios *t = (struct termios *)data;
+			register int i;
+
+			for (i = MAX_SPEED; i >= 0; i--)
+				if (t->c_ispeed == validspeed[i])
+					break;
+				else if (t->c_ispeed > validspeed[i])
+					return (EINVAL);
+			if (i < 0)
+				return (EINVAL);
+			for (i = MAX_SPEED; i >= 0; i--)
+				if (t->c_ospeed == validspeed[i])
+					break;
+				else if (t->c_ospeed > validspeed[i])
+					return (EINVAL);
+			if (i < 0)
+				return (EINVAL);
+
 			ndflush(&tp->t_outq, tp->t_outq.c_cc);
+			}
 			break;
 
 		case TIOCSIG: