[src/trunk]: src/sys/dev/wscons introduce hard limit on maximum font size (WS...

[jdolecek <jdolecek%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/455860bf5252
branches:  trunk
changeset: 513616:455860bf5252
user:      jdolecek <jdolecek%NetBSD.org@localhost>
date:      Sun Aug 05 11:26:52 2001 +0000

description:
introduce hard limit on maximum font size (WSDISPLAY_MAXFONTSZ - 512KB)
and keymap size (WSKBDIO_MAXMAPLEN - 64KB)

diffstat:

 sys/dev/wscons/wsconsio.h  |   6 ++++--
 sys/dev/wscons/wsdisplay.c |  15 +++++++++------
 sys/dev/wscons/wskbd.c     |   7 +++++--
 3 files changed, 18 insertions(+), 10 deletions(-)

diffs (98 lines):

diff -r 77b6ffac143e -r 455860bf5252 sys/dev/wscons/wsconsio.h
--- a/sys/dev/wscons/wsconsio.h Sun Aug 05 11:22:33 2001 +0000
+++ b/sys/dev/wscons/wsconsio.h Sun Aug 05 11:26:52 2001 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: wsconsio.h,v 1.39 2001/03/30 13:06:45 tsutsui Exp $ */
+/* $NetBSD: wsconsio.h,v 1.40 2001/08/05 11:26:52 jdolecek Exp $ */
 
 /*
  * Copyright (c) 1996, 1997 Christopher G. Demetriou.  All rights reserved.
@@ -136,6 +136,7 @@
 /* Manipulate keysym groups. */
 struct wskbd_map_data {
        u_int   maplen;                         /* number of entries in map */
+#define WSKBDIO_MAXMAPLEN      65536
        struct wscons_keymap *map;              /* map to get or set */
 };
 #define WSKBDIO_GETMAP         _IOWR('W', 13, struct wskbd_map_data)
@@ -305,7 +306,8 @@
 #define WSDISPLAY_FONTENC_IBM 1
 #define WSDISPLAY_FONTENC_PCVT 2
 #define WSDISPLAY_FONTENC_ISO7 3 /* greek */
-       int fontwidth, fontheight, stride;
+       u_int fontwidth, fontheight, stride;
+#define WSDISPLAY_MAXFONTSZ    (512*1024)
        int bitorder, byteorder;
 #define        WSDISPLAY_FONTORDER_KNOWN 0             /* i.e, no need to convert */
 #define        WSDISPLAY_FONTORDER_L2R 1
diff -r 77b6ffac143e -r 455860bf5252 sys/dev/wscons/wsdisplay.c
--- a/sys/dev/wscons/wsdisplay.c        Sun Aug 05 11:22:33 2001 +0000
+++ b/sys/dev/wscons/wsdisplay.c        Sun Aug 05 11:26:52 2001 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: wsdisplay.c,v 1.51 2001/05/18 11:49:21 drochner Exp $ */
+/* $NetBSD: wsdisplay.c,v 1.52 2001/08/05 11:26:52 jdolecek Exp $ */
 
 /*
  * Copyright (c) 1996, 1997 Christopher G. Demetriou.  All rights reserved.
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: wsdisplay.c,v 1.51 2001/05/18 11:49:21 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: wsdisplay.c,v 1.52 2001/08/05 11:26:52 jdolecek Exp $");
 
 #include <sys/param.h>
 #include <sys/conf.h>
@@ -1046,6 +1046,7 @@
        int error;
        char *type, typebuf[16], *emul, emulbuf[16];
        void *buf;
+       u_int fontsz;
 #if defined(COMPAT_14) && NWSKBD > 0
        struct wsmux_device wsmuxdata;
 #endif
@@ -1088,10 +1089,12 @@
                        d->name = typebuf;
                } else
                        d->name = "loaded"; /* ??? */
-               buf = malloc(d->fontheight * d->stride * d->numchars,
-                            M_DEVBUF, M_WAITOK);
-               error = copyin(d->data, buf,
-                              d->fontheight * d->stride * d->numchars);
+               fontsz = d->fontheight * d->stride * d->numchars;
+               if (fontsz > WSDISPLAY_MAXFONTSZ)
+                       return (EINVAL);
+
+               buf = malloc(fontsz, M_DEVBUF, M_WAITOK);
+               error = copyin(d->data, buf, fontsz);
                if (error) {
                        free(buf, M_DEVBUF);
                        return (error);
diff -r 77b6ffac143e -r 455860bf5252 sys/dev/wscons/wskbd.c
--- a/sys/dev/wscons/wskbd.c    Sun Aug 05 11:22:33 2001 +0000
+++ b/sys/dev/wscons/wskbd.c    Sun Aug 05 11:26:52 2001 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: wskbd.c,v 1.41 2001/05/30 15:24:25 lukem Exp $ */
+/* $NetBSD: wskbd.c,v 1.42 2001/08/05 11:26:52 jdolecek Exp $ */
 
 /*
  * Copyright (c) 1996, 1997 Christopher G. Demetriou.  All rights reserved.
@@ -34,7 +34,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: wskbd.c,v 1.41 2001/05/30 15:24:25 lukem Exp $");
+__KERNEL_RCSID(0, "$NetBSD: wskbd.c,v 1.42 2001/08/05 11:26:52 jdolecek Exp $");
 
 /*
  * Copyright (c) 1992, 1993
@@ -970,6 +970,9 @@
                if ((flag & FWRITE) == 0)
                        return (EACCES);
                umdp = (struct wskbd_map_data *)data;
+               if (umdp->maplen > WSKBDIO_MAXMAPLEN)
+                       return (EINVAL);
+
                len = umdp->maplen*sizeof(struct wscons_keymap);
                buf = malloc(len, M_TEMP, M_WAITOK);
                error = copyin(umdp->map, buf, len);