Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 6 May 2014 07:07:59 -0700
From:      Matthew Fleming <mdf@FreeBSD.org>
To:        Aleksandr Rybalko <ray@freebsd.org>
Cc:        "svn-src-head@freebsd.org" <svn-src-head@freebsd.org>, "svn-src-all@freebsd.org" <svn-src-all@freebsd.org>, "src-committers@freebsd.org" <src-committers@freebsd.org>
Subject:   Re: svn commit: r265442 - head/sys/dev/vt
Message-ID:  <CAMBSHm-z_yF5JLfF8U6r=z8xQGrLDVqwnAAjA3k7%2BB2X%2BZ=KSw@mail.gmail.com>
In-Reply-To: <201405061352.s46DqE9a025250@svn.freebsd.org>
References:  <201405061352.s46DqE9a025250@svn.freebsd.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, May 6, 2014 at 6:52 AM, Aleksandr Rybalko <ray@freebsd.org> wrote:
> Author: ray
> Date: Tue May  6 13:52:13 2014
> New Revision: 265442
> URL: http://svnweb.freebsd.org/changeset/base/265442
>
> Log:
>   Implement KDMKTONE ioctl.
>
>   Submitted by: Matthew D.Fuller <fullermd@over-yonder.net> (original version)
>   MFC:          7 days
>   PR:           kern/189170
>
>   Sponsored by: The FreeBSD Foundation
>
> Modified:
>   head/sys/dev/vt/vt_core.c
>
> Modified: head/sys/dev/vt/vt_core.c
> ==============================================================================
> --- head/sys/dev/vt/vt_core.c   Tue May  6 13:46:36 2014        (r265441)
> +++ head/sys/dev/vt/vt_core.c   Tue May  6 13:52:13 2014        (r265442)
> @@ -1732,9 +1732,17 @@ skip_thunk:
>                 td->td_frame->tf_rflags &= ~PSL_IOPL;
>  #endif
>                 return (0);
> -       case KDMKTONE:          /* sound the bell */
> -               /* TODO */
> +       case KDMKTONE: {        /* sound the bell */
> +               int freq, period;
> +
> +               freq = 1193182 / ((*(int*)data) & 0xffff);

This data comes from a user and can't be trusted.  This is a potential
divide-by-zero.

> +               period = (((*(int*)data)>>16) & 0xffff) * hz / 1000;

This is signed shift which I can't recall if it's well-defined if the
number is negative.  Using u_int would definitely be defined.

Thanks,
matthew



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAMBSHm-z_yF5JLfF8U6r=z8xQGrLDVqwnAAjA3k7%2BB2X%2BZ=KSw>