[src/trunk]: src/sys/arch/sparc/dev do boundary checks when writing cursor sp...

[macallan <macallan%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/77d051bc24b3
branches:  trunk
changeset: 829309:77d051bc24b3
user:      macallan <macallan%NetBSD.org@localhost>
date:      Thu Jan 25 14:45:58 2018 +0000

description:
do boundary checks when writing cursor sprite colour registers

diffstat:

 sys/arch/sparc/dev/cgfourteen.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (22 lines):

diff -r e25a069fcec6 -r 77d051bc24b3 sys/arch/sparc/dev/cgfourteen.c
--- a/sys/arch/sparc/dev/cgfourteen.c   Thu Jan 25 10:52:49 2018 +0000
+++ b/sys/arch/sparc/dev/cgfourteen.c   Thu Jan 25 14:45:58 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: cgfourteen.c,v 1.84 2018/01/12 23:38:24 macallan Exp $ */
+/*     $NetBSD: cgfourteen.c,v 1.85 2018/01/25 14:45:58 macallan Exp $ */
 
 /*
  * Copyright (c) 1996
@@ -1120,7 +1120,11 @@
        if (cur->which & WSDISPLAY_CURSOR_DOCMAP) {
                int i;
                uint32_t val;
-       
+
+               if ((cur->cmap.index > 2) || (cur->cmap.count > 3) ||
+                   (cur->cmap.index + cur->cmap.count > 3))
+                       return EINVAL;
+
                for (i = 0; i < min(cur->cmap.count, 3); i++) {
                        val = (cur->cmap.red[i] ) |
                              (cur->cmap.green[i] << 8) |