diff options
| author | Gordon Tetlow <gordon@FreeBSD.org> | 2018-04-04 05:43:03 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2018-04-04 05:43:03 +0000 |
| commit | 8411c9ac24aabdbbde468778b35da58dc3c15178 (patch) | |
| tree | 86ded7fd2b24fcb42a6ef3883c4c6eb617e2dfc1 /sys/dev/drm/drm_irq.c | |
| parent | 211072860627f05561c829d09714b201a72562cf (diff) | |
Fix multiple small kernel memory disclosures. [EN-18:04.mem]releng/10.3
Reported by: Ilja van Sprundel
Approved by: so
Security: CVE-2018-6919
Security: FreeBSD-EN-18:04.mem
Notes
Notes:
svn path=/releng/10.3/; revision=331987
Diffstat (limited to 'sys/dev/drm/drm_irq.c')
| -rw-r--r-- | sys/dev/drm/drm_irq.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/dev/drm/drm_irq.c b/sys/dev/drm/drm_irq.c index 8977bcf8a562..a69dfd5f8af6 100644 --- a/sys/dev/drm/drm_irq.c +++ b/sys/dev/drm/drm_irq.c @@ -357,7 +357,7 @@ int drm_modeset_ctl(struct drm_device *dev, void *data, goto out; crtc = modeset->crtc; - if (crtc >= dev->num_crtcs) { + if (crtc < 0 || crtc >= dev->num_crtcs) { ret = EINVAL; goto out; } |