Module Name: src
Committed By: riastradh
Date: Wed Jan 24 05:35:59 UTC 2018
Modified Files:
src/sys/arch/arm/allwinner: awin_debe.c
src/sys/arch/arm/iomd: vidcvideo.c
src/sys/arch/luna68k/dev: lunafb.c
src/sys/arch/pmax/ibus: pm.c
src/sys/dev/ic: bt463.c bt485.c igsfb.c
src/sys/dev/pci: radeonfb.c
src/sys/dev/sbus: tcx.c
src/sys/dev/tc: cfb.c mfb.c sfb.c sfbplus.c stic.c tfb.c xcfb.c
Log Message:
Fix integer overflows noted by Silvio Cesare of InfoSect.
Someone^TM should name these idioms so we can eliminate this class of
copypasta bug.
To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 src/sys/arch/arm/allwinner/awin_debe.c
cvs rdiff -u -r1.44 -r1.45 src/sys/arch/arm/iomd/vidcvideo.c
cvs rdiff -u -r1.36 -r1.37 src/sys/arch/luna68k/dev/lunafb.c
cvs rdiff -u -r1.14 -r1.15 src/sys/arch/pmax/ibus/pm.c
cvs rdiff -u -r1.17 -r1.18 src/sys/dev/ic/bt463.c src/sys/dev/ic/bt485.c
cvs rdiff -u -r1.56 -r1.57 src/sys/dev/ic/igsfb.c
cvs rdiff -u -r1.93 -r1.94 src/sys/dev/pci/radeonfb.c
cvs rdiff -u -r1.57 -r1.58 src/sys/dev/sbus/tcx.c
cvs rdiff -u -r1.61 -r1.62 src/sys/dev/tc/cfb.c src/sys/dev/tc/tfb.c
cvs rdiff -u -r1.59 -r1.60 src/sys/dev/tc/mfb.c
cvs rdiff -u -r1.84 -r1.85 src/sys/dev/tc/sfb.c
cvs rdiff -u -r1.37 -r1.38 src/sys/dev/tc/sfbplus.c
cvs rdiff -u -r1.51 -r1.52 src/sys/dev/tc/stic.c
cvs rdiff -u -r1.55 -r1.56 src/sys/dev/tc/xcfb.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/arm/allwinner/awin_debe.c
diff -u src/sys/arch/arm/allwinner/awin_debe.c:1.20 src/sys/arch/arm/allwinner/awin_debe.c:1.21
--- src/sys/arch/arm/allwinner/awin_debe.c:1.20 Sun Nov 22 17:50:48 2015
+++ src/sys/arch/arm/allwinner/awin_debe.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: awin_debe.c,v 1.20 2015/11/22 17:50:48 aymeric Exp $ */
+/* $NetBSD: awin_debe.c,v 1.21 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 2014 Jared D. McNeill <[email protected]>
@@ -38,7 +38,7 @@
#define AWIN_DEBE_CURMAX 64
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: awin_debe.c,v 1.20 2015/11/22 17:50:48 aymeric Exp $");
+__KERNEL_RCSID(0, "$NetBSD: awin_debe.c,v 1.21 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/bus.h>
@@ -393,7 +393,7 @@ awin_debe_set_cursor(struct awin_debe_so
if (cur->which & WSDISPLAY_CURSOR_DOCMAP) {
index = cur->cmap.index;
count = cur->cmap.count;
- if (index >= 2 || (index + count) > 2)
+ if (index >= 2 || count > 2 - index)
return EINVAL;
error = copyin(cur->cmap.red, &r[index], count);
if (error)
Index: src/sys/arch/arm/iomd/vidcvideo.c
diff -u src/sys/arch/arm/iomd/vidcvideo.c:1.44 src/sys/arch/arm/iomd/vidcvideo.c:1.45
--- src/sys/arch/arm/iomd/vidcvideo.c:1.44 Tue Jan 21 19:31:57 2014
+++ src/sys/arch/arm/iomd/vidcvideo.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: vidcvideo.c,v 1.44 2014/01/21 19:31:57 christos Exp $ */
+/* $NetBSD: vidcvideo.c,v 1.45 2018/01/24 05:35:58 riastradh Exp $ */
/*
* Copyright (c) 2001 Reinoud Zandijk
@@ -30,7 +30,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
-__KERNEL_RCSID(0, "$NetBSD: vidcvideo.c,v 1.44 2014/01/21 19:31:57 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vidcvideo.c,v 1.45 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -667,7 +667,7 @@ set_cmap(struct vidcvideo_softc *sc, str
u_int index = p->index, count = p->count;
int error;
- if (index >= CMAP_SIZE || (index + count) > CMAP_SIZE)
+ if (index >= CMAP_SIZE || count > CMAP_SIZE - index)
return EINVAL;
error = copyin(p->red, &cmap.r[index], count);
Index: src/sys/arch/luna68k/dev/lunafb.c
diff -u src/sys/arch/luna68k/dev/lunafb.c:1.36 src/sys/arch/luna68k/dev/lunafb.c:1.37
--- src/sys/arch/luna68k/dev/lunafb.c:1.36 Sat Oct 4 16:58:17 2014
+++ src/sys/arch/luna68k/dev/lunafb.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: lunafb.c,v 1.36 2014/10/04 16:58:17 tsutsui Exp $ */
+/* $NetBSD: lunafb.c,v 1.37 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 2000 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
-__KERNEL_RCSID(0, "$NetBSD: lunafb.c,v 1.36 2014/10/04 16:58:17 tsutsui Exp $");
+__KERNEL_RCSID(0, "$NetBSD: lunafb.c,v 1.37 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -345,7 +345,7 @@ omsetcmap(struct omfb_softc *sc, struct
int cmsize, i, error;
cmsize = sc->sc_dc->dc_cmsize;
- if (index >= cmsize || (index + count) > cmsize)
+ if (index >= cmsize || count > cmsize - index)
return (EINVAL);
error = copyin(p->red, &cmap.r[index], count);
Index: src/sys/arch/pmax/ibus/pm.c
diff -u src/sys/arch/pmax/ibus/pm.c:1.14 src/sys/arch/pmax/ibus/pm.c:1.15
--- src/sys/arch/pmax/ibus/pm.c:1.14 Fri Jan 5 13:11:32 2018
+++ src/sys/arch/pmax/ibus/pm.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: pm.c,v 1.14 2018/01/05 13:11:32 flxd Exp $ */
+/* $NetBSD: pm.c,v 1.15 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: pm.c,v 1.14 2018/01/05 13:11:32 flxd Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pm.c,v 1.15 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/buf.h>
@@ -742,7 +742,7 @@ pm_set_cursor(struct pm_softc *sc, struc
if ((v & WSDISPLAY_CURSOR_DOCMAP) != 0) {
index = p->cmap.index;
count = p->cmap.count;
- if (index >= 2 || (index + count) > 2)
+ if (index >= 2 || count > 2 - index)
return (EINVAL);
rv = copyin(p->cmap.red, &cc->cc_color[index], count);
Index: src/sys/dev/ic/bt463.c
diff -u src/sys/dev/ic/bt463.c:1.17 src/sys/dev/ic/bt463.c:1.18
--- src/sys/dev/ic/bt463.c:1.17 Mon Jun 24 03:57:36 2013
+++ src/sys/dev/ic/bt463.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: bt463.c,v 1.17 2013/06/24 03:57:36 riastradh Exp $ */
+/* $NetBSD: bt463.c,v 1.18 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -62,7 +62,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: bt463.c,v 1.17 2013/06/24 03:57:36 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bt463.c,v 1.18 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -416,7 +416,7 @@ bt463_check_curcmap(struct ramdac_cookie
int count, index, error;
if (cursorp->cmap.index > 2 ||
- (cursorp->cmap.index + cursorp->cmap.count) > 2)
+ cursorp->cmap.count > 2 - cursorp->cmap.index)
return (EINVAL);
count = cursorp->cmap.count;
index = cursorp->cmap.index;
Index: src/sys/dev/ic/bt485.c
diff -u src/sys/dev/ic/bt485.c:1.17 src/sys/dev/ic/bt485.c:1.18
--- src/sys/dev/ic/bt485.c:1.17 Mon Jun 24 03:57:36 2013
+++ src/sys/dev/ic/bt485.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: bt485.c,v 1.17 2013/06/24 03:57:36 riastradh Exp $ */
+/* $NetBSD: bt485.c,v 1.18 2018/01/24 05:35:58 riastradh Exp $ */
/*
* Copyright (c) 1995, 1996 Carnegie-Mellon University.
@@ -32,7 +32,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: bt485.c,v 1.17 2013/06/24 03:57:36 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bt485.c,v 1.18 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -330,7 +330,7 @@ bt485_set_cursor(struct ramdac_cookie *r
*/
if (v & WSDISPLAY_CURSOR_DOCMAP) {
if (cursorp->cmap.index > 2 ||
- (cursorp->cmap.index + cursorp->cmap.count) > 2)
+ cursorp->cmap.count > 2 - cursorp->cmap.index)
return (EINVAL);
count = cursorp->cmap.count;
index = cursorp->cmap.index;
Index: src/sys/dev/ic/igsfb.c
diff -u src/sys/dev/ic/igsfb.c:1.56 src/sys/dev/ic/igsfb.c:1.57
--- src/sys/dev/ic/igsfb.c:1.56 Wed Jan 25 17:31:55 2017
+++ src/sys/dev/ic/igsfb.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: igsfb.c,v 1.56 2017/01/25 17:31:55 jakllsch Exp $ */
+/* $NetBSD: igsfb.c,v 1.57 2018/01/24 05:35:58 riastradh Exp $ */
/*
* Copyright (c) 2002, 2003 Valeriy E. Ushakov
@@ -31,7 +31,7 @@
* Integraphics Systems IGA 168x and CyberPro series.
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: igsfb.c,v 1.56 2017/01/25 17:31:55 jakllsch Exp $");
+__KERNEL_RCSID(0, "$NetBSD: igsfb.c,v 1.57 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -812,9 +812,10 @@ igsfb_update_cmap(struct igsfb_devconfig
if (index >= IGS_CMAP_SIZE)
return;
- last = index + count;
- if (last > IGS_CMAP_SIZE)
+ if (count > IGS_CMAP_SIZE - index)
last = IGS_CMAP_SIZE;
+ else
+ last = index + count;
t = dc->dc_iot;
h = dc->dc_ioh;
Index: src/sys/dev/pci/radeonfb.c
diff -u src/sys/dev/pci/radeonfb.c:1.93 src/sys/dev/pci/radeonfb.c:1.94
--- src/sys/dev/pci/radeonfb.c:1.93 Wed Oct 11 17:08:32 2017
+++ src/sys/dev/pci/radeonfb.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: radeonfb.c,v 1.93 2017/10/11 17:08:32 macallan Exp $ */
+/* $NetBSD: radeonfb.c,v 1.94 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 2006 Itronix Inc.
@@ -70,7 +70,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: radeonfb.c,v 1.93 2017/10/11 17:08:32 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: radeonfb.c,v 1.94 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -2756,8 +2756,7 @@ radeonfb_putcmap(struct radeonfb_display
#ifdef GENFB_DEBUG
aprint_debug("putcmap: %d %d\n",index, count);
#endif
- if (cm->index >= 256 || cm->count > 256 ||
- (cm->index + cm->count) > 256)
+ if (index >= 256 || count > 256 - index)
return EINVAL;
error = copyin(cm->red, &rbuf[index], count);
if (error)
@@ -2792,7 +2791,7 @@ radeonfb_getcmap(struct radeonfb_display
u_int count = cm->count;
int error;
- if (index >= 255 || count > 256 || index + count > 256)
+ if (index >= 256 || count > 256 - index)
return EINVAL;
error = copyout(&dp->rd_cmap_red[index], cm->red, count);
@@ -3605,8 +3604,8 @@ radeonfb_set_cursor(struct radeonfb_disp
if (flags & WSDISPLAY_CURSOR_DOCMAP) {
index = wc->cmap.index;
count = wc->cmap.count;
-
- if (index >= 2 || (index + count) > 2)
+
+ if (index >= 2 || count > 2 - index)
return EINVAL;
err = copyin(wc->cmap.red, &r[index], count);
Index: src/sys/dev/sbus/tcx.c
diff -u src/sys/dev/sbus/tcx.c:1.57 src/sys/dev/sbus/tcx.c:1.58
--- src/sys/dev/sbus/tcx.c:1.57 Fri Sep 23 17:45:25 2016
+++ src/sys/dev/sbus/tcx.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: tcx.c,v 1.57 2016/09/23 17:45:25 macallan Exp $ */
+/* $NetBSD: tcx.c,v 1.58 2018/01/24 05:35:58 riastradh Exp $ */
/*
* Copyright (c) 1996, 1998, 2009 The NetBSD Foundation, Inc.
@@ -38,7 +38,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tcx.c,v 1.57 2016/09/23 17:45:25 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcx.c,v 1.58 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -474,6 +474,8 @@ tcxioctl(dev_t dev, u_long cmd, void *da
case FBIOGETCMAP:
#define p ((struct fbcmap *)data)
+ if (p->index > 256 || p->count > 256 - p->index)
+ return EINVAL;
if (copyout(&sc->sc_cmap_red[p->index], p->red, p->count) != 0)
return EINVAL;
if (copyout(&sc->sc_cmap_green[p->index], p->green, p->count)
@@ -486,6 +488,8 @@ tcxioctl(dev_t dev, u_long cmd, void *da
case FBIOPUTCMAP:
/* copy to software map */
+ if (p->index > 256 || p->count > 256 - p->index)
+ return EINVAL;
if (copyin(p->red, &sc->sc_cmap_red[p->index], p->count) != 0)
return EINVAL;
if (copyin(p->green, &sc->sc_cmap_green[p->index], p->count)
Index: src/sys/dev/tc/cfb.c
diff -u src/sys/dev/tc/cfb.c:1.61 src/sys/dev/tc/cfb.c:1.62
--- src/sys/dev/tc/cfb.c:1.61 Wed Jan 11 21:12:36 2012
+++ src/sys/dev/tc/cfb.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: cfb.c,v 1.61 2012/01/11 21:12:36 macallan Exp $ */
+/* $NetBSD: cfb.c,v 1.62 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 1998, 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: cfb.c,v 1.61 2012/01/11 21:12:36 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: cfb.c,v 1.62 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -719,7 +719,7 @@ set_cursor(struct cfb_softc *sc, struct
if (v & WSDISPLAY_CURSOR_DOCMAP) {
index = p->cmap.index;
count = p->cmap.count;
- if (index >= 2 || (index + count) > 2)
+ if (index >= 2 || count > 2 - index)
return (EINVAL);
error = copyin(p->cmap.red, &r[index], count);
if (error)
Index: src/sys/dev/tc/tfb.c
diff -u src/sys/dev/tc/tfb.c:1.61 src/sys/dev/tc/tfb.c:1.62
--- src/sys/dev/tc/tfb.c:1.61 Wed Jan 11 21:12:36 2012
+++ src/sys/dev/tc/tfb.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: tfb.c,v 1.61 2012/01/11 21:12:36 macallan Exp $ */
+/* $NetBSD: tfb.c,v 1.62 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 1998, 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tfb.c,v 1.61 2012/01/11 21:12:36 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tfb.c,v 1.62 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -777,7 +777,7 @@ set_cursor(struct tfb_softc *sc, struct
if (v & WSDISPLAY_CURSOR_DOCMAP) {
index = p->cmap.index;
count = p->cmap.count;
- if (index >= 2 || (index + count) > 2)
+ if (index >= 2 || count > 2 - index)
return (EINVAL);
error = copyin(p->cmap.red, &r[index], count);
if (error)
Index: src/sys/dev/tc/mfb.c
diff -u src/sys/dev/tc/mfb.c:1.59 src/sys/dev/tc/mfb.c:1.60
--- src/sys/dev/tc/mfb.c:1.59 Mon Nov 4 16:53:09 2013
+++ src/sys/dev/tc/mfb.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: mfb.c,v 1.59 2013/11/04 16:53:09 christos Exp $ */
+/* $NetBSD: mfb.c,v 1.60 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 1998, 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: mfb.c,v 1.59 2013/11/04 16:53:09 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: mfb.c,v 1.60 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -617,7 +617,7 @@ set_cursor(struct mfb_softc *sc, struct
if (v & WSDISPLAY_CURSOR_DOCMAP) {
index = p->cmap.index;
count = p->cmap.count;
- if (index >= 2 || (index + count) > 2)
+ if (index >= 2 || count > 2 - index)
return (EINVAL);
error = copyin(p->cmap.red, &color[index], count);
if (error)
Index: src/sys/dev/tc/sfb.c
diff -u src/sys/dev/tc/sfb.c:1.84 src/sys/dev/tc/sfb.c:1.85
--- src/sys/dev/tc/sfb.c:1.84 Wed Jan 11 21:12:36 2012
+++ src/sys/dev/tc/sfb.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: sfb.c,v 1.84 2012/01/11 21:12:36 macallan Exp $ */
+/* $NetBSD: sfb.c,v 1.85 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 1998, 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sfb.c,v 1.84 2012/01/11 21:12:36 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sfb.c,v 1.85 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -773,7 +773,7 @@ set_cursor(struct sfb_softc *sc, struct
if (v & WSDISPLAY_CURSOR_DOCMAP) {
index = p->cmap.index;
count = p->cmap.count;
- if (index >= 2 || (index + count) > 2)
+ if (index >= 2 || count > 2 - index)
return (EINVAL);
error = copyin(p->cmap.red, &r[index], count);
if (error)
Index: src/sys/dev/tc/sfbplus.c
diff -u src/sys/dev/tc/sfbplus.c:1.37 src/sys/dev/tc/sfbplus.c:1.38
--- src/sys/dev/tc/sfbplus.c:1.37 Wed Jan 11 21:12:36 2012
+++ src/sys/dev/tc/sfbplus.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: sfbplus.c,v 1.37 2012/01/11 21:12:36 macallan Exp $ */
+/* $NetBSD: sfbplus.c,v 1.38 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 1999, 2000, 2001 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sfbplus.c,v 1.37 2012/01/11 21:12:36 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sfbplus.c,v 1.38 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -757,7 +757,7 @@ set_cursor(struct sfbp_softc *sc, struct
if (v & WSDISPLAY_CURSOR_DOCMAP) {
index = p->cmap.index;
count = p->cmap.count;
- if (index >= 2 || (index + count) > 2)
+ if (index >= 2 || count > 2 - index)
return (EINVAL);
error = copyin(p->cmap.red, &r[index], count);
if (error)
Index: src/sys/dev/tc/stic.c
diff -u src/sys/dev/tc/stic.c:1.51 src/sys/dev/tc/stic.c:1.52
--- src/sys/dev/tc/stic.c:1.51 Fri Jul 25 08:10:39 2014
+++ src/sys/dev/tc/stic.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: stic.c,v 1.51 2014/07/25 08:10:39 dholland Exp $ */
+/* $NetBSD: stic.c,v 1.52 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 1999, 2000, 2001 The NetBSD Foundation, Inc.
@@ -36,7 +36,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: stic.c,v 1.51 2014/07/25 08:10:39 dholland Exp $");
+__KERNEL_RCSID(0, "$NetBSD: stic.c,v 1.52 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -1305,7 +1305,7 @@ stic_set_cursor(struct stic_info *si, st
if ((v & WSDISPLAY_CURSOR_DOCMAP) != 0) {
index = p->cmap.index;
count = p->cmap.count;
- if (index >= 2 || (index + count) > 2)
+ if (index >= 2 || count > 2 - index)
return (EINVAL);
error = copyin(p->cmap.red, &r[index], count);
if (error)
Index: src/sys/dev/tc/xcfb.c
diff -u src/sys/dev/tc/xcfb.c:1.55 src/sys/dev/tc/xcfb.c:1.56
--- src/sys/dev/tc/xcfb.c:1.55 Wed Jan 11 21:12:37 2012
+++ src/sys/dev/tc/xcfb.c Wed Jan 24 05:35:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: xcfb.c,v 1.55 2012/01/11 21:12:37 macallan Exp $ */
+/* $NetBSD: xcfb.c,v 1.56 2018/01/24 05:35:58 riastradh Exp $ */
/*-
* Copyright (c) 1998, 1999 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xcfb.c,v 1.55 2012/01/11 21:12:37 macallan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xcfb.c,v 1.56 2018/01/24 05:35:58 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -595,7 +595,7 @@ set_cursor(struct xcfb_softc *sc, struct
index = p->cmap.index;
count = p->cmap.count;
- if (index >= 2 || index + count > 2)
+ if (index >= 2 || count > 2 - index)
return (EINVAL);
error = copyin(p->cmap.red, &r[index], count);
if (error)
