mirror of
https://github.com/freebsd/freebsd-src
synced 2024-11-05 18:22:52 +00:00
Fixed two security holes in the pcmmap() function.
Submitted by: Bruce Evans
This commit is contained in:
parent
04dc4fc21c
commit
2048dd682c
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=5240
3 changed files with 9 additions and 9 deletions
|
@ -35,7 +35,7 @@
|
|||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: syscons.c,v 1.83 1994/12/18 19:45:53 joerg Exp $
|
||||
* $Id: syscons.c,v 1.84 1994/12/26 17:50:18 ats Exp $
|
||||
*/
|
||||
|
||||
#include "sc.h"
|
||||
|
@ -2635,8 +2635,8 @@ getchar(void)
|
|||
int
|
||||
pcmmap(dev_t dev, int offset, int nprot)
|
||||
{
|
||||
if (offset > 0x20000)
|
||||
return EINVAL;
|
||||
if (offset > 0x20000 - PAGE_SIZE)
|
||||
return -1;
|
||||
return i386_btop((VIDEOMEM + offset));
|
||||
}
|
||||
|
||||
|
|
|
@ -35,7 +35,7 @@
|
|||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: syscons.c,v 1.83 1994/12/18 19:45:53 joerg Exp $
|
||||
* $Id: syscons.c,v 1.84 1994/12/26 17:50:18 ats Exp $
|
||||
*/
|
||||
|
||||
#include "sc.h"
|
||||
|
@ -2635,8 +2635,8 @@ getchar(void)
|
|||
int
|
||||
pcmmap(dev_t dev, int offset, int nprot)
|
||||
{
|
||||
if (offset > 0x20000)
|
||||
return EINVAL;
|
||||
if (offset > 0x20000 - PAGE_SIZE)
|
||||
return -1;
|
||||
return i386_btop((VIDEOMEM + offset));
|
||||
}
|
||||
|
||||
|
|
|
@ -35,7 +35,7 @@
|
|||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||
* SUCH DAMAGE.
|
||||
*
|
||||
* $Id: syscons.c,v 1.83 1994/12/18 19:45:53 joerg Exp $
|
||||
* $Id: syscons.c,v 1.84 1994/12/26 17:50:18 ats Exp $
|
||||
*/
|
||||
|
||||
#include "sc.h"
|
||||
|
@ -2635,8 +2635,8 @@ getchar(void)
|
|||
int
|
||||
pcmmap(dev_t dev, int offset, int nprot)
|
||||
{
|
||||
if (offset > 0x20000)
|
||||
return EINVAL;
|
||||
if (offset > 0x20000 - PAGE_SIZE)
|
||||
return -1;
|
||||
return i386_btop((VIDEOMEM + offset));
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue