Subject: [NetBSD-i386] illegal index into pc_tty in pccons.c
To: None <netbsd-bugs@sun-lamp.cs.berkeley.edu>
From: Frank van der Linden <vdlinden@fwi.uva.nl>
List: netbsd-bugs
Date: 08/17/1994 21:05:43
DESCRIPTION
if /etc/ttys contains an enabled entry for a PC console with a minor
number > 0 and you are using the pccons console driver, the index into
the array pc_tty will have a value that is illegal.
line 98 of pccons.c: struct tty *pc_tty[NPC];
line 431 of pccons.c: if (unit > pccd.cd_ndevs)
line 434 of pccons.c if (!pc_tty[unit])
since NPC == 1, the only legal value for an index into pc_tty is 0.
However, pccd.cd_ndevs == 4 according to the output of a printf
debug statement I put on line 430.So any enabled device in /etc/ttys
with a major number 12 and a minor number between 0 and 4 will cause
trouble.
REPEAT BY
Booting a netbsd kernel with the pccons console driver and a /etc/ttys
file that has at least the following entries:
console "/usr/libexec/getty Pc" pc3 off secure
ttyv0 "/usr/libexec/getty Pc" pc3 on secure
ttyv1 "/usr/libexec/getty Pc" pc3 on secure
ttyv2 "/usr/libexec/getty Pc" pc3 on secure
ttyv3 "/usr/libexec/getty Pc" pc3 on secure
ttyv4 "/usr/libexec/getty Pc" pc3 on secure
This will cause a vm_fault when ttyflags -a is executed from /etc/rc.
FIXED BY
*** usr/src/sys/arch/i386/isa/pccons.c.orig Thu May 5 18:41:56 1994
--- usr/src/sys/arch/i386/isa/pccons.c Wed Aug 17 20:17:21 1994
***************
*** 429,433 ****
struct tty *tp;
! if (unit >= pccd.cd_ndevs)
return ENXIO;
--- 429,433 ----
struct tty *tp;
! if (unit >= NPC)
return ENXIO;
Onno van der Linden c/o vdlinden@fwi.uva.nl (Frank van der Linden)
------------------------------------------------------------------------------