From 4f2eff8c323604882ac513c2adca6592af35339f Mon Sep 17 00:00:00 2001 From: Jacques Vidrine Date: Sat, 3 Apr 2004 15:28:25 +0000 Subject: [PATCH] Correct a potential panic condition that could be caused when getting or setting the VGA palette. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by: Christer Öberg Reviewed by: bde --- sys/dev/fb/vga.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/dev/fb/vga.c b/sys/dev/fb/vga.c index 461c2074434..7bde1d9059a 100644 --- a/sys/dev/fb/vga.c +++ b/sys/dev/fb/vga.c @@ -2854,7 +2854,8 @@ get_palette(video_adapter_t *adp, int base, int count, u_char *g; u_char *b; - if ((base < 0) || (base >= 256) || (base + count > 256)) + if (count < 0 || base < 0 || count > 256 || base > 256 || + base + count > 256) return EINVAL; r = malloc(count*3, M_DEVBUF, M_WAITOK); @@ -2885,7 +2886,8 @@ set_palette(video_adapter_t *adp, int base, int count, u_char *b; int err; - if ((base < 0) || (base >= 256) || (base + count > 256)) + if (count < 0 || base < 0 || count > 256 || base > 256 || + base + count > 256) return EINVAL; r = malloc(count*3, M_DEVBUF, M_WAITOK);