diff options
author | gordon <gordon@FreeBSD.org> | 2018-04-04 05:33:56 +0000 |
---|---|---|
committer | gordon <gordon@FreeBSD.org> | 2018-04-04 05:33:56 +0000 |
commit | 0e2c6eafc8392d9e3fb835393c03c3f02b0e00fb (patch) | |
tree | 4672336044b4392ee3a494f796e454b65e7c485f /sys | |
parent | 312f06f761f7362e153ed5a1a9c49e17294e52b5 (diff) | |
download | FreeBSD-src-0e2c6eafc8392d9e3fb835393c03c3f02b0e00fb.zip FreeBSD-src-0e2c6eafc8392d9e3fb835393c03c3f02b0e00fb.tar.gz |
Fix vt console memory disclosure. [SA-18:04.vt]
Bump newvers.sh and UPDATING for today's patches.
Submitted by: emaste
Reported by: Dr Silvio Cesare of InfoSect
Approved by: so
Security: CVE-2018-6917
Security: FreeBSD-SA-18:04.vt
Sponsored by: The FreeBSD Foundation
Diffstat (limited to 'sys')
-rw-r--r-- | sys/conf/newvers.sh | 2 | ||||
-rw-r--r-- | sys/dev/vt/vt_font.c | 4 |
2 files changed, 4 insertions, 2 deletions
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index 2341b62..f296585 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -44,7 +44,7 @@ TYPE="FreeBSD" REVISION="11.1" -BRANCH="RELEASE-p8" +BRANCH="RELEASE-p9" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi diff --git a/sys/dev/vt/vt_font.c b/sys/dev/vt/vt_font.c index 4c369c6..1e65e70 100644 --- a/sys/dev/vt/vt_font.c +++ b/sys/dev/vt/vt_font.c @@ -42,6 +42,7 @@ static MALLOC_DEFINE(M_VTFONT, "vtfont", "vt font"); /* Some limits to prevent abnormal fonts from being loaded. */ #define VTFONT_MAXMAPPINGS 65536 +#define VTFONT_MAXGLYPHS 131072 #define VTFONT_MAXGLYPHSIZE 2097152 #define VTFONT_MAXDIMENSION 128 @@ -171,7 +172,8 @@ vtfont_load(vfnt_t *f, struct vt_font **ret) /* Make sure the dimensions are valid. */ if (f->width < 1 || f->height < 1) return (EINVAL); - if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION) + if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION || + f->glyph_count > VTFONT_MAXGLYPHS) return (E2BIG); /* Not too many mappings. */ |