diff options
| author | nectar <nectar@FreeBSD.org> | 2004-09-29 21:36:07 +0000 |
|---|---|---|
| committer | nectar <nectar@FreeBSD.org> | 2004-09-29 21:36:07 +0000 |
| commit | 611fe940a3f8e543d2d35ee4e4ac916e0c94f864 (patch) | |
| tree | 2a80f18ea8d3a870211f804a314e36facc1bc7c9 /sys | |
| parent | e1f9385d4bb3eb22e2342f291f5ae75946d5a5cf (diff) | |
| download | FreeBSD-src-611fe940a3f8e543d2d35ee4e4ac916e0c94f864.zip FreeBSD-src-611fe940a3f8e543d2d35ee4e4ac916e0c94f864.tar.gz | |
Disallow negative coordinates and sizes in the syscons CONS_SCRSHOT
ioctl.
Reported by: Christer Oberg <christer.oberg@deprotect.com>
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/syscons/syscons.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/dev/syscons/syscons.c b/sys/dev/syscons/syscons.c index a98ef4b..4b0295a 100644 --- a/sys/dev/syscons/syscons.c +++ b/sys/dev/syscons/syscons.c @@ -853,14 +853,16 @@ scioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td) scrshot_t *ptr = (scrshot_t *)data; void *outp = ptr->buf; + if (ptr->x < 0 || ptr->y < 0 || ptr->xsize < 0 || ptr->ysize < 0) + return EINVAL; s = spltty(); if (ISGRAPHSC(scp)) { splx(s); return EOPNOTSUPP; } hist_rsz = (scp->history != NULL) ? scp->history->vtb_rows : 0; - if ((ptr->x + ptr->xsize) > scp->xsize || - (ptr->y + ptr->ysize) > (scp->ysize + hist_rsz)) { + if (((u_int)ptr->x + ptr->xsize) > scp->xsize || + ((u_int)ptr->y + ptr->ysize) > (scp->ysize + hist_rsz)) { splx(s); return EINVAL; } |
