mirror of
https://git.FreeBSD.org/src.git
synced 2025-01-27 16:39:08 +00:00
Disallow negative coordinates and sizes in the syscons CONS_SCRSHOT
ioctl. Reported by: Christer Oberg <christer.oberg@deprotect.com>
This commit is contained in:
parent
780afd18cd
commit
e618ea0cdb
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=135942
@ -853,14 +853,16 @@ scioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
|
||||
scrshot_t *ptr = (scrshot_t *)data;
|
||||
void *outp = ptr->buf;
|
||||
|
||||
if (ptr->x < 0 || ptr->y < 0 || ptr->xsize < 0 || ptr->ysize < 0)
|
||||
return EINVAL;
|
||||
s = spltty();
|
||||
if (ISGRAPHSC(scp)) {
|
||||
splx(s);
|
||||
return EOPNOTSUPP;
|
||||
}
|
||||
hist_rsz = (scp->history != NULL) ? scp->history->vtb_rows : 0;
|
||||
if ((ptr->x + ptr->xsize) > scp->xsize ||
|
||||
(ptr->y + ptr->ysize) > (scp->ysize + hist_rsz)) {
|
||||
if (((u_int)ptr->x + ptr->xsize) > scp->xsize ||
|
||||
((u_int)ptr->y + ptr->ysize) > (scp->ysize + hist_rsz)) {
|
||||
splx(s);
|
||||
return EINVAL;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user