kern/50413: the vcons_putwschar function does not check for invalid values going through ioctl

[vchaves%ymail.com@localhost]

>Number:         50413
>Category:       kern
>Synopsis:       the vcons_putwschar function does not check for invalid values going through ioctl
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 08 16:00:00 +0000 2015
>Originator:     Vicente Chaves
>Release:        netbsd-current
>Organization:
>Environment:
NetBSD nb7.vbox.lab 7.99.21 NetBSD 7.99.21 (GENERIC) #0: Thu Nov  5 18:32:03 UTC 2015  vchaves%netbsd7.vbox.lab@localhost:/home/vchaves/current/build/sys/arch/amd64/compile/GENERIC amd64
>Description:
Even when wsc->flags parameter from userland, through ioctl, contains invalid attributes, the vcons_putwschar() function does not check the function return ri->riops.allocattr() and passes the variable attr
directly to the vcons_putchar() function with a value of undefined.
>How-To-Repeat:
Use the wsmoused when the display is using driver genfb
>Fix:
nb7# cvs diff -u sys/dev/wscons/
cvs diff: Diffing .
cvs diff: Diffing sys
cvs diff: Diffing sys/dev
cvs diff: Diffing sys/dev/wscons
Index: sys/dev/wscons/wsdisplay_vcons.c
===================================================================
RCS file: /cvsroot/src/sys/dev/wscons/wsdisplay_vcons.c,v
retrieving revision 1.34
diff -u -r1.34 wsdisplay_vcons.c
--- sys/dev/wscons/wsdisplay_vcons.c    19 Jul 2015 13:22:42 -0000      1.34
+++ sys/dev/wscons/wsdisplay_vcons.c    8 Nov 2015 15:51:31 -0000
@@ -1140,6 +1140,7 @@
 {
        long attr;
        struct rasops_info *ri;
+       int error;

        KASSERT(scr != NULL && wsc != NULL);

@@ -1152,8 +1153,12 @@
        if ((wsc->row >= 0) && (wsc->row < ri->ri_rows) && (wsc->col >= 0) &&
             (wsc->col < ri->ri_cols)) {

-               ri->ri_ops.allocattr(ri, wsc->foreground, wsc->background,
+               error = ri->ri_ops.allocattr(ri, wsc->foreground, wsc->background,
                    wsc->flags, &attr);
+
+                if (error)
+                    return error;
+
                vcons_putchar(ri, wsc->row, wsc->col, wsc->letter, attr);
 #ifdef VCONS_DEBUG
                printf("vcons_putwschar(%d, %d, %x, %lx\n", wsc->row, wsc->col,