[src/trunk]: src/sys/arch/amiga/dev integer overflow. reported by silvio@qua...

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/a2bfb32db77f
branches:  trunk
changeset: 534933:a2bfb32db77f
user:      itojun <itojun%NetBSD.org@localhost>
date:      Tue Aug 06 22:44:38 2002 +0000

description:
integer overflow.  reported by silvio%qualys.com@localhost

diffstat:

 sys/arch/amiga/dev/grf_cv3d.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r 880baf4931e8 -r a2bfb32db77f sys/arch/amiga/dev/grf_cv3d.c
--- a/sys/arch/amiga/dev/grf_cv3d.c     Tue Aug 06 21:43:51 2002 +0000
+++ b/sys/arch/amiga/dev/grf_cv3d.c     Tue Aug 06 22:44:38 2002 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: grf_cv3d.c,v 1.10 2002/03/17 19:40:29 atatat Exp $ */
+/*     $NetBSD: grf_cv3d.c,v 1.11 2002/08/06 22:44:38 itojun Exp $ */
 
 /*
  * Copyright (c) 1995 Michael Teske
@@ -33,7 +33,7 @@
 #include "opt_amigacons.h"
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: grf_cv3d.c,v 1.10 2002/03/17 19:40:29 atatat Exp $");
+__KERNEL_RCSID(0, "$NetBSD: grf_cv3d.c,v 1.11 2002/08/06 22:44:38 itojun Exp $");
 
 #include "grfcv3d.h"
 #if NGRFCV3D > 0
@@ -962,7 +962,7 @@
        if (cmap->count == 0 || cmap->index >= 256)
                return (0);
 
-       if (cmap->index + cmap->count > 256)
+       if (cmap->count > 256 - cmap->index)
                cmap->count = 256 - cmap->index;
 
        /* first read colors out of the chip, then copyout to userspace */