[src/trunk]: src/sys/arch integer overflow. from silvio%qualys.com@localhost

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/761f2f542a3e
branches:  trunk
changeset: 534934:761f2f542a3e
user:      itojun <itojun%NetBSD.org@localhost>
date:      Tue Aug 06 22:46:11 2002 +0000

description:
integer overflow. from silvio%qualys.com@localhost

diffstat:

 sys/arch/arm/iomd/vidcvideo.c    |  6 +++---
 sys/arch/i386/i386/sys_machdep.c |  9 ++++-----
 sys/arch/luna68k/dev/lunafb.c    |  6 +++---
 3 files changed, 10 insertions(+), 11 deletions(-)

diffs (84 lines):

diff -r a2bfb32db77f -r 761f2f542a3e sys/arch/arm/iomd/vidcvideo.c
--- a/sys/arch/arm/iomd/vidcvideo.c     Tue Aug 06 22:44:38 2002 +0000
+++ b/sys/arch/arm/iomd/vidcvideo.c     Tue Aug 06 22:46:11 2002 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: vidcvideo.c,v 1.13 2002/07/04 14:43:48 junyoung Exp $ */
+/* $NetBSD: vidcvideo.c,v 1.14 2002/08/06 22:46:11 itojun Exp $ */
 
 /*
  * Copyright (c) 2001 Reinoud Zandijk
@@ -36,7 +36,7 @@
 
 #include <sys/cdefs.h>                 /* RCS ID & Copyright macro defns */
 
-__KERNEL_RCSID(0, "$NetBSD: vidcvideo.c,v 1.13 2002/07/04 14:43:48 junyoung Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vidcvideo.c,v 1.14 2002/08/06 22:46:11 itojun Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -766,7 +766,7 @@
 {
        u_int index = p->index, count = p->count;
 
-       if (index >= CMAP_SIZE || (index + count) > CMAP_SIZE)
+       if (index >= CMAP_SIZE || count > CMAP_SIZE - index)
                return (EINVAL);
 
        if (!uvm_useracc(p->red, count, B_WRITE) ||
diff -r a2bfb32db77f -r 761f2f542a3e sys/arch/i386/i386/sys_machdep.c
--- a/sys/arch/i386/i386/sys_machdep.c  Tue Aug 06 22:44:38 2002 +0000
+++ b/sys/arch/i386/i386/sys_machdep.c  Tue Aug 06 22:46:11 2002 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: sys_machdep.c,v 1.63 2002/08/03 00:12:48 itojun Exp $  */
+/*     $NetBSD: sys_machdep.c,v 1.64 2002/08/06 22:47:44 itojun Exp $  */
 
 /*-
  * Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sys_machdep.c,v 1.63 2002/08/03 00:12:48 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sys_machdep.c,v 1.64 2002/08/06 22:47:44 itojun Exp $");
 
 #include "opt_vm86.h"
 #include "opt_user_ldt.h"
@@ -180,9 +180,8 @@
            ua.num, ua.desc);
 #endif
 
-       if (ua.start < 0 || ua.num < 0)
-               return (EINVAL);
-       if (ua.start > 8192 || (ua.start + ua.num) > 8192)
+       if (ua.start < 0 || ua.num < 0 || ua.start > 8192 || ua.num > 8192 ||
+           ua.start + ua.num > 8192)
                return (EINVAL);
 
        descv = malloc(sizeof (*descv) * ua.num, M_TEMP, M_NOWAIT);
diff -r a2bfb32db77f -r 761f2f542a3e sys/arch/luna68k/dev/lunafb.c
--- a/sys/arch/luna68k/dev/lunafb.c     Tue Aug 06 22:44:38 2002 +0000
+++ b/sys/arch/luna68k/dev/lunafb.c     Tue Aug 06 22:46:11 2002 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: lunafb.c,v 1.8 2002/07/04 14:43:49 junyoung Exp $ */
+/* $NetBSD: lunafb.c,v 1.9 2002/08/06 22:48:13 itojun Exp $ */
 
 /*-
  * Copyright (c) 2000 The NetBSD Foundation, Inc.
@@ -38,7 +38,7 @@
 
 #include <sys/cdefs.h>                 /* RCS ID & Copyright macro defns */
 
-__KERNEL_RCSID(0, "$NetBSD: lunafb.c,v 1.8 2002/07/04 14:43:49 junyoung Exp $");
+__KERNEL_RCSID(0, "$NetBSD: lunafb.c,v 1.9 2002/08/06 22:48:13 itojun Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -299,7 +299,7 @@
         int cmsize;
 
        cmsize = sc->sc_dc->dc_cmsize;
-       if (index >= cmsize || (index + count) > cmsize)
+       if (index >= cmsize || count > cmsize - index)
                return (EINVAL);
 
        if (!uvm_useracc(p->red, count, B_WRITE) ||