From 8a085494317cab6fef25b34521dae03c83f31eaa Mon Sep 17 00:00:00 2001 From: Nicolas Pitre Date: Tue, 8 Jan 2019 22:55:02 -0500 Subject: vcsa: clamp header values when they don't fit The /dev/vcsa* devices have a fixed char-sized header that stores the screen geometry and cursor location. Let's make sure it doesn't contain random garbage when those values exceed 255. If ever it becomes necessary to convey larger screen info to user space then a larger header in the not-yet-implemented /dev/vcsua* devices should be considered. Signed-off-by: Nicolas Pitre Signed-off-by: Greg Kroah-Hartman --- drivers/tty/vt/vc_screen.c | 5 +++-- drivers/tty/vt/vt.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) (limited to 'drivers/tty/vt') diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index 2384ea85ffaf..3dba60825c08 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -335,8 +335,9 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) if (p < HEADER_SIZE) { size_t tmp_count; - con_buf0[0] = (char)vc->vc_rows; - con_buf0[1] = (char)vc->vc_cols; + /* clamp header values if they don't fit */ + con_buf0[0] = min(vc->vc_rows, 0xFFu); + con_buf0[1] = min(vc->vc_cols, 0xFFu); getconsxy(vc, con_buf0 + 2); con_buf_start += p; diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 41ec8e5010f3..7cfa19963316 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4607,8 +4607,9 @@ EXPORT_SYMBOL_GPL(screen_pos); void getconsxy(struct vc_data *vc, unsigned char *p) { - p[0] = vc->vc_x; - p[1] = vc->vc_y; + /* clamp values if they don't fit */ + p[0] = min(vc->vc_x, 0xFFu); + p[1] = min(vc->vc_y, 0xFFu); } void putconsxy(struct vc_data *vc, unsigned char *p) -- cgit v1.2.3