Date: Thu, 18 Sep 2014 12:20:20 +0000 (UTC) From: Jean-Sebastien Pedron <dumbbell@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r271756 - head/sys/dev/vt Message-ID: <201409181220.s8ICKKOO003340@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: dumbbell Date: Thu Sep 18 12:20:19 2014 New Revision: 271756 URL: http://svnweb.freebsd.org/changeset/base/271756 Log: vt(4): Fix out-of-bounds array access in VT_ACTIVATE ioctl handling CID: 1229964 MFC after: 3 days Modified: head/sys/dev/vt/vt_core.c Modified: head/sys/dev/vt/vt_core.c ============================================================================== --- head/sys/dev/vt/vt_core.c Thu Sep 18 11:52:28 2014 (r271755) +++ head/sys/dev/vt/vt_core.c Thu Sep 18 12:20:19 2014 (r271756) @@ -2131,7 +2131,7 @@ skip_thunk: win = *(int *)data - 1; DPRINTF(5, "%s%d: VT_ACTIVATE ttyv%d ", SC_DRIVER_NAME, VT_UNIT(vw), win); - if ((win > VT_MAXWINDOWS) || (win < 0)) + if ((win >= VT_MAXWINDOWS) || (win < 0)) return (EINVAL); return (vt_proc_window_switch(vd->vd_windows[win])); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201409181220.s8ICKKOO003340>