[src/trunk]: src/sys/dev/wscons wscons(4): Paranoia: Clamp numbers of rows an...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/8b5207b1cc17
branches:  trunk
changeset: 373648:8b5207b1cc17
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Thu Feb 23 02:48:06 2023 +0000

description:
wscons(4): Paranoia: Clamp numbers of rows and columns.

diffstat:

 sys/dev/wscons/wsemul_vt100.c      |  14 ++++++++++----
 sys/dev/wscons/wsemul_vt100_subr.c |   6 ++++--
 2 files changed, 14 insertions(+), 6 deletions(-)

diffs (62 lines):

diff -r 1e1a43cddbb4 -r 8b5207b1cc17 sys/dev/wscons/wsemul_vt100.c
--- a/sys/dev/wscons/wsemul_vt100.c     Thu Feb 23 02:47:52 2023 +0000
+++ b/sys/dev/wscons/wsemul_vt100.c     Thu Feb 23 02:48:06 2023 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: wsemul_vt100.c,v 1.49 2022/01/02 23:46:21 uwe Exp $    */
+/*     $NetBSD: wsemul_vt100.c,v 1.50 2023/02/23 02:48:06 riastradh Exp $      */
 
 /*
  * Copyright (c) 1998
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: wsemul_vt100.c,v 1.49 2022/01/02 23:46:21 uwe Exp $");
+__KERNEL_RCSID(0, "$NetBSD: wsemul_vt100.c,v 1.50 2023/02/23 02:48:06 riastradh Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_wsmsgattrs.h"
@@ -293,8 +293,14 @@
 {
        struct wsemul_vt100_emuldata *edp = cookie;
 
-       edp->bd.nrows = type->nrows;
-       edp->bd.ncols = type->ncols;
+       /* XXX match malloc size in wsemul_vt100_attach */
+       KASSERT(type->nrows >= 0);
+       KASSERT(type->ncols >= 0);
+       KASSERT(type->nrows <= 1024);
+       KASSERT(type->ncols <= 1024);
+
+       edp->bd.nrows = MAX(0, MIN(type->nrows, 1024));
+       edp->bd.ncols = MAX(0, MIN(type->ncols, 1024));
        wsemul_vt100_reset(edp);
        wsemul_vt100_resetop(cookie, WSEMUL_CLEARSCREEN);
 }
diff -r 1e1a43cddbb4 -r 8b5207b1cc17 sys/dev/wscons/wsemul_vt100_subr.c
--- a/sys/dev/wscons/wsemul_vt100_subr.c        Thu Feb 23 02:47:52 2023 +0000
+++ b/sys/dev/wscons/wsemul_vt100_subr.c        Thu Feb 23 02:48:06 2023 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: wsemul_vt100_subr.c,v 1.27 2023/02/23 02:47:52 riastradh Exp $ */
+/* $NetBSD: wsemul_vt100_subr.c,v 1.28 2023/02/23 02:48:06 riastradh Exp $ */
 
 /*
  * Copyright (c) 1998
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: wsemul_vt100_subr.c,v 1.27 2023/02/23 02:47:52 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: wsemul_vt100_subr.c,v 1.28 2023/02/23 02:48:06 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -767,6 +767,8 @@
                return;
            case DCSTYPE_TABRESTORE:
                KASSERT(edp->tabs != 0);
+               KASSERT(edp->ncols >= 0);
+               KASSERT(edp->ncols <= 1024);
                memset(edp->tabs, 0, edp->ncols);
                pos = 0;
                for (i = 0; i < edp->dcspos; i++) {