Subject: [NetBSD-i386] illegal index into pc_tty in pccons.c
To: None <netbsd-bugs@sun-lamp.cs.berkeley.edu>
From: Frank van der Linden <vdlinden@fwi.uva.nl>
List: netbsd-bugs
Date: 08/17/1994 21:05:43
DESCRIPTION

   if /etc/ttys contains an enabled entry for a PC console with a minor
   number > 0 and you are using the pccons console driver, the index into
   the array pc_tty will have a value that is illegal.

   line 98 of pccons.c: struct tty *pc_tty[NPC];
   line 431 of pccons.c: if (unit > pccd.cd_ndevs)
   line 434 of pccons.c if (!pc_tty[unit])

   since NPC == 1, the only legal value for an index into pc_tty is 0.

   However, pccd.cd_ndevs == 4 according to the output of a printf
   debug statement I put on line 430.So any enabled device in /etc/ttys
   with a major number 12 and a minor number between 0 and 4 will cause
   trouble.

REPEAT BY

   Booting a netbsd kernel with the pccons console driver and a /etc/ttys
   file that has at least the following entries:
console	"/usr/libexec/getty Pc"		pc3 off secure
ttyv0  	"/usr/libexec/getty Pc"		pc3 on secure
ttyv1  	"/usr/libexec/getty Pc"		pc3 on secure
ttyv2  	"/usr/libexec/getty Pc"		pc3 on secure
ttyv3  	"/usr/libexec/getty Pc"		pc3 on secure
ttyv4  	"/usr/libexec/getty Pc"		pc3 on secure
  This will cause a vm_fault when ttyflags -a is executed from /etc/rc.

FIXED BY

*** usr/src/sys/arch/i386/isa/pccons.c.orig	Thu May  5 18:41:56 1994
--- usr/src/sys/arch/i386/isa/pccons.c	Wed Aug 17 20:17:21 1994
***************
*** 429,433 ****
  	struct tty *tp;
  
! 	if (unit >= pccd.cd_ndevs)
  		return ENXIO;
  
--- 429,433 ----
  	struct tty *tp;
  
! 	if (unit >= NPC)
  		return ENXIO;


Onno van der Linden    c/o     vdlinden@fwi.uva.nl (Frank van der Linden)

------------------------------------------------------------------------------