diff options
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/conf/newvers.sh | 2 | ||||
| -rw-r--r-- | sys/i386/isa/vesa.c | 4 | ||||
| -rw-r--r-- | sys/kern/uipc_syscalls.c | 10 |
3 files changed, 14 insertions, 2 deletions
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index f76f913b862f..7bf7c7a7a7ad 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -36,7 +36,7 @@ TYPE="FreeBSD" REVISION="4.4" -BRANCH="RELEASE-p25" +BRANCH="RELEASE-p26" RELEASE="${REVISION}-${BRANCH}" VERSION="${TYPE} ${RELEASE}" diff --git a/sys/i386/isa/vesa.c b/sys/i386/isa/vesa.c index 3fc68afb0651..630501c0526a 100644 --- a/sys/i386/isa/vesa.c +++ b/sys/i386/isa/vesa.c @@ -1317,7 +1317,9 @@ get_palette(video_adapter_t *adp, int base, int count, int bits; int error; - if ((base < 0) || (base >= 256) || (base + count > 256)) + if ((base < 0) || (base >= 256) || (count < 0) || (count > 256)) + return 1; + if (base + count > 256) return 1; if (!(vesa_adp_info->v_flags & V_DAC8) || !VESA_MODE(adp->va_mode)) return 1; diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c index 4b8735fd6671..3c652b9725a1 100644 --- a/sys/kern/uipc_syscalls.c +++ b/sys/kern/uipc_syscalls.c @@ -206,6 +206,8 @@ accept1(p, uap, compat) sizeof (namelen)); if(error) return (error); + if (namelen < 0) + return (EINVAL); } error = holdsock(fdp, uap->s, &lfp); if (error) @@ -1193,6 +1195,10 @@ getsockname1(p, uap, compat) fdrop(fp, p); return (error); } + if (len < 0) { + fdrop(fp, p); + return (EINVAL); + } so = (struct socket *)fp->f_data; sa = 0; error = (*so->so_proto->pr_usrreqs->pru_sockaddr)(so, &sa); @@ -1272,6 +1278,10 @@ getpeername1(p, uap, compat) fdrop(fp, p); return (error); } + if (len < 0) { + fdrop(fp, p); + return (EINVAL); + } sa = 0; error = (*so->so_proto->pr_usrreqs->pru_peeraddr)(so, &sa); if (error) |