Date: Thu, 25 Aug 2016 12:04:58 +0000 (UTC) From: Bruce Evans <bde@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r304800 - head/sys/dev/syscons Message-ID: <201608251204.u7PC4wQs052417@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: bde Date: Thu Aug 25 12:04:57 2016 New Revision: 304800 URL: https://svnweb.freebsd.org/changeset/base/304800 Log: Fix logic errors in bounds checks in previous commit. The 2-entry stack was overrun for grab levels larger than 2. Reported by: pluknet Modified: head/sys/dev/syscons/syscons.c Modified: head/sys/dev/syscons/syscons.c ============================================================================== --- head/sys/dev/syscons/syscons.c Thu Aug 25 10:53:03 2016 (r304799) +++ head/sys/dev/syscons/syscons.c Thu Aug 25 12:04:57 2016 (r304800) @@ -1729,7 +1729,7 @@ sc_cngrab(struct consdev *cp) sc = sc_console->sc; lev = atomic_fetchadd_int(&sc->grab_level, 1); - if (lev >= 0 || lev < 2) + if (lev >= 0 && lev < 2) sccnopen(sc, &sc->grab_state[lev], 1 | 2); } @@ -1741,7 +1741,7 @@ sc_cnungrab(struct consdev *cp) sc = sc_console->sc; lev = atomic_load_acq_int(&sc->grab_level) - 1; - if (lev >= 0 || lev < 2) + if (lev >= 0 && lev < 2) sccnclose(sc, &sc->grab_state[lev]); atomic_add_int(&sc->grab_level, -1); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201608251204.u7PC4wQs052417>