From 749613741cd63bc8b0d7bf9a44197eaf5b019a06 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=B8ren=20Schmidt?= Date: Tue, 26 Apr 1994 09:09:57 +0000 Subject: [PATCH] Fixed missing bounds check in scroll up/down sequence, that could cause a panic (and did). --- sys/dev/syscons/syscons.c | 16 +++++++++++----- sys/i386/isa/syscons.c | 16 +++++++++++----- sys/isa/syscons.c | 16 +++++++++++----- 3 files changed, 33 insertions(+), 15 deletions(-) diff --git a/sys/dev/syscons/syscons.c b/sys/dev/syscons/syscons.c index 5ad55ea9827..87572956f84 100644 --- a/sys/dev/syscons/syscons.c +++ b/sys/dev/syscons/syscons.c @@ -35,7 +35,7 @@ * SUCH DAMAGE. * * from:@(#)syscons.c 1.3 940129 - * $Id: syscons.c,v 1.43 1994/04/12 00:05:23 ache Exp $ + * $Id: syscons.c,v 1.44 1994/04/21 14:22:26 sos Exp $ * */ @@ -849,11 +849,11 @@ int pcioctl(dev_t dev, int cmd, caddr_t data, int flag, struct proc *p) outb(TIMER_CNTR2, pitch); outb(TIMER_CNTR2, (pitch>>8)); /* enable counter 2 output to speaker */ - outb(0x61, inb(0x61) | 3); + outb(IO_PPI, inb(IO_PPI) | 3); } else { /* disable counter 2 output to speaker */ - outb(0x61, inb(0x61) & 0xFC); + outb(IO_PPI, inb(IO_PPI) & 0xFC); release_timer2(); } } @@ -1692,6 +1692,8 @@ static void scan_esc(scr_stat *scp, u_char c) case 'S': /* scroll up n lines */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->ypos) + n = scp->ypos; bcopy(scp->crt_base + (scp->xsize * n), scp->crt_base, scp->xsize * (scp->ysize - n) * @@ -1704,16 +1706,20 @@ static void scan_esc(scr_stat *scp, u_char c) case 'T': /* scroll down n lines */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->ysize - scp->ypos) + n = scp->ysize - scp->ypos; bcopy(scp->crt_base, scp->crt_base + (scp->xsize * n), scp->xsize * (scp->ysize - n) * sizeof(u_short)); - fillw(scp->term.cur_attr | scr_map[0x20], scp->crt_base, - scp->xsize); + fillw(scp->term.cur_attr | scr_map[0x20], + scp->crt_base, scp->xsize); break; case 'X': /* delete n characters in line */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->xsize - scp->xpos) + n = scp->xsize - scp->xpos; fillw(scp->term.cur_attr | scr_map[0x20], scp->crt_base + scp->xpos + ((scp->xsize*scp->ypos) * sizeof(u_short)), n); diff --git a/sys/i386/isa/syscons.c b/sys/i386/isa/syscons.c index 5ad55ea9827..87572956f84 100644 --- a/sys/i386/isa/syscons.c +++ b/sys/i386/isa/syscons.c @@ -35,7 +35,7 @@ * SUCH DAMAGE. * * from:@(#)syscons.c 1.3 940129 - * $Id: syscons.c,v 1.43 1994/04/12 00:05:23 ache Exp $ + * $Id: syscons.c,v 1.44 1994/04/21 14:22:26 sos Exp $ * */ @@ -849,11 +849,11 @@ int pcioctl(dev_t dev, int cmd, caddr_t data, int flag, struct proc *p) outb(TIMER_CNTR2, pitch); outb(TIMER_CNTR2, (pitch>>8)); /* enable counter 2 output to speaker */ - outb(0x61, inb(0x61) | 3); + outb(IO_PPI, inb(IO_PPI) | 3); } else { /* disable counter 2 output to speaker */ - outb(0x61, inb(0x61) & 0xFC); + outb(IO_PPI, inb(IO_PPI) & 0xFC); release_timer2(); } } @@ -1692,6 +1692,8 @@ static void scan_esc(scr_stat *scp, u_char c) case 'S': /* scroll up n lines */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->ypos) + n = scp->ypos; bcopy(scp->crt_base + (scp->xsize * n), scp->crt_base, scp->xsize * (scp->ysize - n) * @@ -1704,16 +1706,20 @@ static void scan_esc(scr_stat *scp, u_char c) case 'T': /* scroll down n lines */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->ysize - scp->ypos) + n = scp->ysize - scp->ypos; bcopy(scp->crt_base, scp->crt_base + (scp->xsize * n), scp->xsize * (scp->ysize - n) * sizeof(u_short)); - fillw(scp->term.cur_attr | scr_map[0x20], scp->crt_base, - scp->xsize); + fillw(scp->term.cur_attr | scr_map[0x20], + scp->crt_base, scp->xsize); break; case 'X': /* delete n characters in line */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->xsize - scp->xpos) + n = scp->xsize - scp->xpos; fillw(scp->term.cur_attr | scr_map[0x20], scp->crt_base + scp->xpos + ((scp->xsize*scp->ypos) * sizeof(u_short)), n); diff --git a/sys/isa/syscons.c b/sys/isa/syscons.c index 5ad55ea9827..87572956f84 100644 --- a/sys/isa/syscons.c +++ b/sys/isa/syscons.c @@ -35,7 +35,7 @@ * SUCH DAMAGE. * * from:@(#)syscons.c 1.3 940129 - * $Id: syscons.c,v 1.43 1994/04/12 00:05:23 ache Exp $ + * $Id: syscons.c,v 1.44 1994/04/21 14:22:26 sos Exp $ * */ @@ -849,11 +849,11 @@ int pcioctl(dev_t dev, int cmd, caddr_t data, int flag, struct proc *p) outb(TIMER_CNTR2, pitch); outb(TIMER_CNTR2, (pitch>>8)); /* enable counter 2 output to speaker */ - outb(0x61, inb(0x61) | 3); + outb(IO_PPI, inb(IO_PPI) | 3); } else { /* disable counter 2 output to speaker */ - outb(0x61, inb(0x61) & 0xFC); + outb(IO_PPI, inb(IO_PPI) & 0xFC); release_timer2(); } } @@ -1692,6 +1692,8 @@ static void scan_esc(scr_stat *scp, u_char c) case 'S': /* scroll up n lines */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->ypos) + n = scp->ypos; bcopy(scp->crt_base + (scp->xsize * n), scp->crt_base, scp->xsize * (scp->ysize - n) * @@ -1704,16 +1706,20 @@ static void scan_esc(scr_stat *scp, u_char c) case 'T': /* scroll down n lines */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->ysize - scp->ypos) + n = scp->ysize - scp->ypos; bcopy(scp->crt_base, scp->crt_base + (scp->xsize * n), scp->xsize * (scp->ysize - n) * sizeof(u_short)); - fillw(scp->term.cur_attr | scr_map[0x20], scp->crt_base, - scp->xsize); + fillw(scp->term.cur_attr | scr_map[0x20], + scp->crt_base, scp->xsize); break; case 'X': /* delete n characters in line */ n = scp->term.param[0]; if (n < 1) n = 1; + if (n > scp->xsize - scp->xpos) + n = scp->xsize - scp->xpos; fillw(scp->term.cur_attr | scr_map[0x20], scp->crt_base + scp->xpos + ((scp->xsize*scp->ypos) * sizeof(u_short)), n);