From 611fe940a3f8e543d2d35ee4e4ac916e0c94f864 Mon Sep 17 00:00:00 2001 From: nectar Date: Wed, 29 Sep 2004 21:36:07 +0000 Subject: Disallow negative coordinates and sizes in the syscons CONS_SCRSHOT ioctl. Reported by: Christer Oberg --- sys/dev/syscons/syscons.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'sys') diff --git a/sys/dev/syscons/syscons.c b/sys/dev/syscons/syscons.c index a98ef4b..4b0295a 100644 --- a/sys/dev/syscons/syscons.c +++ b/sys/dev/syscons/syscons.c @@ -853,14 +853,16 @@ scioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td) scrshot_t *ptr = (scrshot_t *)data; void *outp = ptr->buf; + if (ptr->x < 0 || ptr->y < 0 || ptr->xsize < 0 || ptr->ysize < 0) + return EINVAL; s = spltty(); if (ISGRAPHSC(scp)) { splx(s); return EOPNOTSUPP; } hist_rsz = (scp->history != NULL) ? scp->history->vtb_rows : 0; - if ((ptr->x + ptr->xsize) > scp->xsize || - (ptr->y + ptr->ysize) > (scp->ysize + hist_rsz)) { + if (((u_int)ptr->x + ptr->xsize) > scp->xsize || + ((u_int)ptr->y + ptr->ysize) > (scp->ysize + hist_rsz)) { splx(s); return EINVAL; } -- cgit v1.1