Author: dumbbell
Date: Thu Sep 18 12:20:19 2014
New Revision: 271756
URL: http://svnweb.freebsd.org/changeset/base/271756
Log:
vt(4): Fix out-of-bounds array access in VT_ACTIVATE ioctl handling
CID: 1229964
MFC after: 3 days
Modified:
head/sys/dev/vt/vt_core.c
Modified: head/sys/dev/vt/vt_core.c
==============================================================================
--- head/sys/dev/vt/vt_core.c Thu Sep 18 11:52:28 2014 (r271755)
+++ head/sys/dev/vt/vt_core.c Thu Sep 18 12:20:19 2014 (r271756)
@@ -2131,7 +2131,7 @@ skip_thunk:
win = *(int *)data - 1;
DPRINTF(5, "%s%d: VT_ACTIVATE ttyv%d ", SC_DRIVER_NAME,
VT_UNIT(vw), win);
- if ((win > VT_MAXWINDOWS) || (win < 0))
+ if ((win >= VT_MAXWINDOWS) || (win < 0))
return (EINVAL);
return (vt_proc_window_switch(vd->vd_windows[win]));
}
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
