[src/netbsd-7]: src/sys Pull up following revision(s) (requested by spz in ti...

[snj <snj%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/7d6db1aaf444
branches:  netbsd-7
changeset: 800228:7d6db1aaf444
user:      snj <snj%NetBSD.org@localhost>
date:      Thu Jun 15 05:52:59 2017 +0000

description:
Pull up following revision(s) (requested by spz in ticket #1432):
        sys/arch/ews4800mips/sbd/fb_sbdio.c: revision 1.16
        sys/arch/pmax/ibus/pm.c: revision 1.13
        sys/dev/hpc/bivideo.c: revision 1.34
        sys/dev/ic/sti.c: revision 1.19
correct size checks so they cannot be circumvented by integer overflows
reported by CTurt, thanks for the notification

diffstat:

 sys/arch/ews4800mips/sbd/fb_sbdio.c |  8 ++++++--
 sys/arch/pmax/ibus/pm.c             |  8 ++++----
 sys/dev/hpc/bivideo.c               |  8 ++++----
 sys/dev/ic/sti.c                    |  8 ++++----
 4 files changed, 18 insertions(+), 14 deletions(-)

diffs (137 lines):

diff -r 61fd5cc58f6e -r 7d6db1aaf444 sys/arch/ews4800mips/sbd/fb_sbdio.c
--- a/sys/arch/ews4800mips/sbd/fb_sbdio.c       Sat Jun 03 17:53:38 2017 +0000
+++ b/sys/arch/ews4800mips/sbd/fb_sbdio.c       Thu Jun 15 05:52:59 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: fb_sbdio.c,v 1.13.4.1 2014/11/10 17:59:56 snj Exp $    */
+/*     $NetBSD: fb_sbdio.c,v 1.13.4.2 2017/06/15 05:52:59 snj Exp $    */
 
 /*-
  * Copyright (c) 2004, 2005 The NetBSD Foundation, Inc.
@@ -32,7 +32,7 @@
 #define WIRED_FB_TLB
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: fb_sbdio.c,v 1.13.4.1 2014/11/10 17:59:56 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: fb_sbdio.c,v 1.13.4.2 2017/06/15 05:52:59 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -303,6 +303,8 @@
                if (ri->ri_flg == RI_FORCEMONO)
                        break;
                ga_clut_get(ga);
+               if (cmap->index >= 256 || cmap->count > 256 - cmap->index)
+                       return (EINVAL);
                for (i = 0; i < cmap->count; i++) {
                        cmap->red[i] = ga->clut[cmap->index + i][0];
                        cmap->green[i] = ga->clut[cmap->index + i][1];
@@ -313,6 +315,8 @@
        case WSDISPLAYIO_PUTCMAP:
                if (ri->ri_flg == RI_FORCEMONO)
                        break;
+               if (cmap->index >= 256 || cmap->count > 256 - cmap->index)
+                       return (EINVAL);
                for (i = 0; i < cmap->count; i++) {
                        ga->clut[cmap->index + i][0] = cmap->red[i];
                        ga->clut[cmap->index + i][1] = cmap->green[i];
diff -r 61fd5cc58f6e -r 7d6db1aaf444 sys/arch/pmax/ibus/pm.c
--- a/sys/arch/pmax/ibus/pm.c   Sat Jun 03 17:53:38 2017 +0000
+++ b/sys/arch/pmax/ibus/pm.c   Thu Jun 15 05:52:59 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: pm.c,v 1.12 2013/11/10 20:09:52 christos Exp $ */
+/*     $NetBSD: pm.c,v 1.12.4.1 2017/06/15 05:52:59 snj Exp $  */
 
 /*-
  * Copyright (c) 2002, 2003 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: pm.c,v 1.12 2013/11/10 20:09:52 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pm.c,v 1.12.4.1 2017/06/15 05:52:59 snj Exp $");
 
 #include <sys/param.h>
 #include <sys/buf.h>
@@ -666,7 +666,7 @@
        index = p->index;
        count = p->count;
 
-       if (index >= sc->sc_cmap_size || (index + count) > sc->sc_cmap_size)
+       if (index >= sc->sc_cmap_size || count > sc->sc_cmap_size - index)
                return (EINVAL);
 
        if ((rv = copyout(&sc->sc_cmap.r[index], p->red, count)) != 0)
@@ -685,7 +685,7 @@
        index = p->index;
        count = p->count;
 
-       if (index >= sc->sc_cmap_size || (index + count) > sc->sc_cmap_size)
+       if (index >= sc->sc_cmap_size || count > sc->sc_cmap_size - index)
                return (EINVAL);
 
        if ((rv = copyin(p->red, &sc->sc_cmap.r[index], count)) != 0)
diff -r 61fd5cc58f6e -r 7d6db1aaf444 sys/dev/hpc/bivideo.c
--- a/sys/dev/hpc/bivideo.c     Sat Jun 03 17:53:38 2017 +0000
+++ b/sys/dev/hpc/bivideo.c     Thu Jun 15 05:52:59 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $ */
+/*     $NetBSD: bivideo.c,v 1.33.12.1 2017/06/15 05:53:00 snj Exp $    */
 
 /*-
  * Copyright (c) 1999-2001
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.33 2012/10/27 17:18:17 chs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bivideo.c,v 1.33.12.1 2017/06/15 05:53:00 snj Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_hpcfb.h"
@@ -402,8 +402,8 @@
 
                if (sc->sc_fbconf.hf_class != HPCFB_CLASS_INDEXCOLOR ||
                    sc->sc_fbconf.hf_pack_width != 8 ||
-                   256 <= cmap->index ||
-                   256 < (cmap->index + cmap->count))
+                   cmap->index >= 256 ||
+                   cmap->count > 256 - cmap->index)
                        return (EINVAL);
 
                error = copyout(&bivideo_cmap_r[cmap->index], cmap->red,
diff -r 61fd5cc58f6e -r 7d6db1aaf444 sys/dev/ic/sti.c
--- a/sys/dev/ic/sti.c  Sat Jun 03 17:53:38 2017 +0000
+++ b/sys/dev/ic/sti.c  Thu Jun 15 05:52:59 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: sti.c,v 1.18 2014/06/29 04:08:43 tsutsui Exp $ */
+/*     $NetBSD: sti.c,v 1.18.2.1 2017/06/15 05:53:00 snj Exp $ */
 
 /*     $OpenBSD: sti.c,v 1.61 2009/09/05 14:09:35 miod Exp $   */
 
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sti.c,v 1.18 2014/06/29 04:08:43 tsutsui Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sti.c,v 1.18.2.1 2017/06/15 05:53:00 snj Exp $");
 
 #include "wsdisplay.h"
 
@@ -1017,7 +1017,7 @@
                cmapp = (struct wsdisplay_cmap *)data;
                idx = cmapp->index;
                count = cmapp->count;
-               if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
+               if (idx >= STI_NCMAP || count > STI_NCMAP - idx)
                        return EINVAL;
                if ((ret = copyout(&scr->scr_rcmap[idx], cmapp->red, count)))
                        break;
@@ -1033,7 +1033,7 @@
                cmapp = (struct wsdisplay_cmap *)data;
                idx = cmapp->index;
                count = cmapp->count;
-               if (idx >= STI_NCMAP || idx + count > STI_NCMAP)
+               if (idx >= STI_NCMAP || count > STI_NCMAP - idx)
                        return EINVAL;
                if ((ret = copyin(cmapp->red, &scr->scr_rcmap[idx], count)))
                        break;