Module Name: src
Committed By: macallan
Date: Thu Jan 25 14:45:58 UTC 2018
Modified Files:
src/sys/arch/sparc/dev: cgfourteen.c
Log Message:
do boundary checks when writing cursor sprite colour registers
To generate a diff of this commit:
cvs rdiff -u -r1.84 -r1.85 src/sys/arch/sparc/dev/cgfourteen.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/sparc/dev/cgfourteen.c
diff -u src/sys/arch/sparc/dev/cgfourteen.c:1.84 src/sys/arch/sparc/dev/cgfourteen.c:1.85
--- src/sys/arch/sparc/dev/cgfourteen.c:1.84 Fri Jan 12 23:38:24 2018
+++ src/sys/arch/sparc/dev/cgfourteen.c Thu Jan 25 14:45:58 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: cgfourteen.c,v 1.84 2018/01/12 23:38:24 macallan Exp $ */
+/* $NetBSD: cgfourteen.c,v 1.85 2018/01/25 14:45:58 macallan Exp $ */
/*
* Copyright (c) 1996
@@ -1120,7 +1120,11 @@ cg14_do_cursor(struct cgfourteen_softc *
if (cur->which & WSDISPLAY_CURSOR_DOCMAP) {
int i;
uint32_t val;
-
+
+ if ((cur->cmap.index > 2) || (cur->cmap.count > 3) ||
+ (cur->cmap.index + cur->cmap.count > 3))
+ return EINVAL;
+
for (i = 0; i < min(cur->cmap.count, 3); i++) {
val = (cur->cmap.red[i] ) |
(cur->cmap.green[i] << 8) |
