summaryrefslogtreecommitdiffstats
path: root/sys
diff options
context:
space:
mode:
authorgordon <gordon@FreeBSD.org>2018-04-04 05:33:56 +0000
committergordon <gordon@FreeBSD.org>2018-04-04 05:33:56 +0000
commit0e2c6eafc8392d9e3fb835393c03c3f02b0e00fb (patch)
tree4672336044b4392ee3a494f796e454b65e7c485f /sys
parent312f06f761f7362e153ed5a1a9c49e17294e52b5 (diff)
downloadFreeBSD-src-0e2c6eafc8392d9e3fb835393c03c3f02b0e00fb.zip
FreeBSD-src-0e2c6eafc8392d9e3fb835393c03c3f02b0e00fb.tar.gz
Fix vt console memory disclosure. [SA-18:04.vt]
Bump newvers.sh and UPDATING for today's patches. Submitted by: emaste Reported by: Dr Silvio Cesare of InfoSect Approved by: so Security: CVE-2018-6917 Security: FreeBSD-SA-18:04.vt Sponsored by: The FreeBSD Foundation
Diffstat (limited to 'sys')
-rw-r--r--sys/conf/newvers.sh2
-rw-r--r--sys/dev/vt/vt_font.c4
2 files changed, 4 insertions, 2 deletions
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 2341b62..f296585 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -44,7 +44,7 @@
TYPE="FreeBSD"
REVISION="11.1"
-BRANCH="RELEASE-p8"
+BRANCH="RELEASE-p9"
if [ -n "${BRANCH_OVERRIDE}" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
diff --git a/sys/dev/vt/vt_font.c b/sys/dev/vt/vt_font.c
index 4c369c6..1e65e70 100644
--- a/sys/dev/vt/vt_font.c
+++ b/sys/dev/vt/vt_font.c
@@ -42,6 +42,7 @@ static MALLOC_DEFINE(M_VTFONT, "vtfont", "vt font");
/* Some limits to prevent abnormal fonts from being loaded. */
#define VTFONT_MAXMAPPINGS 65536
+#define VTFONT_MAXGLYPHS 131072
#define VTFONT_MAXGLYPHSIZE 2097152
#define VTFONT_MAXDIMENSION 128
@@ -171,7 +172,8 @@ vtfont_load(vfnt_t *f, struct vt_font **ret)
/* Make sure the dimensions are valid. */
if (f->width < 1 || f->height < 1)
return (EINVAL);
- if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION)
+ if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION ||
+ f->glyph_count > VTFONT_MAXGLYPHS)
return (E2BIG);
/* Not too many mappings. */
OpenPOWER on IntegriCloud