integer overflow. reported by silvio@qualys.com
This commit is contained in:
parent
26bc8b27f4
commit
05d221783a
|
@ -1,4 +1,4 @@
|
|||
/* $NetBSD: grf_cv3d.c,v 1.10 2002/03/17 19:40:29 atatat Exp $ */
|
||||
/* $NetBSD: grf_cv3d.c,v 1.11 2002/08/06 22:44:38 itojun Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 1995 Michael Teske
|
||||
|
@ -33,7 +33,7 @@
|
|||
#include "opt_amigacons.h"
|
||||
|
||||
#include <sys/cdefs.h>
|
||||
__KERNEL_RCSID(0, "$NetBSD: grf_cv3d.c,v 1.10 2002/03/17 19:40:29 atatat Exp $");
|
||||
__KERNEL_RCSID(0, "$NetBSD: grf_cv3d.c,v 1.11 2002/08/06 22:44:38 itojun Exp $");
|
||||
|
||||
#include "grfcv3d.h"
|
||||
#if NGRFCV3D > 0
|
||||
|
@ -962,7 +962,7 @@ cv3d_getcmap(struct grf_softc *gfp, struct grf_colormap *cmap)
|
|||
if (cmap->count == 0 || cmap->index >= 256)
|
||||
return (0);
|
||||
|
||||
if (cmap->index + cmap->count > 256)
|
||||
if (cmap->count > 256 - cmap->index)
|
||||
cmap->count = 256 - cmap->index;
|
||||
|
||||
/* first read colors out of the chip, then copyout to userspace */
|
||||
|
|
Loading…
Reference in New Issue