integer overflow. reported by silvio@qualys.com

This commit is contained in:
itojun 2002-08-06 22:44:38 +00:00
parent 26bc8b27f4
commit 05d221783a
1 changed files with 3 additions and 3 deletions

View File

@ -1,4 +1,4 @@
/* $NetBSD: grf_cv3d.c,v 1.10 2002/03/17 19:40:29 atatat Exp $ */
/* $NetBSD: grf_cv3d.c,v 1.11 2002/08/06 22:44:38 itojun Exp $ */
/*
* Copyright (c) 1995 Michael Teske
@ -33,7 +33,7 @@
#include "opt_amigacons.h"
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: grf_cv3d.c,v 1.10 2002/03/17 19:40:29 atatat Exp $");
__KERNEL_RCSID(0, "$NetBSD: grf_cv3d.c,v 1.11 2002/08/06 22:44:38 itojun Exp $");
#include "grfcv3d.h"
#if NGRFCV3D > 0
@ -962,7 +962,7 @@ cv3d_getcmap(struct grf_softc *gfp, struct grf_colormap *cmap)
if (cmap->count == 0 || cmap->index >= 256)
return (0);
if (cmap->index + cmap->count > 256)
if (cmap->count > 256 - cmap->index)
cmap->count = 256 - cmap->index;
/* first read colors out of the chip, then copyout to userspace */