From 9843ac187b078c9b4d8233b35fc9304043cd9500 Mon Sep 17 00:00:00 2001 From: Brett Gordon Date: Fri, 8 Jul 2016 10:55:04 -0400 Subject: [PATCH] dragon-nx32: fix box bounds checking for gfx calls --- Kernel/platform-dragon-nx32/devtty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Kernel/platform-dragon-nx32/devtty.c b/Kernel/platform-dragon-nx32/devtty.c index 21758bf8..278d432b 100644 --- a/Kernel/platform-dragon-nx32/devtty.c +++ b/Kernel/platform-dragon-nx32/devtty.c @@ -396,7 +396,7 @@ static int gfx_draw_op(uarg_t arg, char *ptr, uint8_t *buf) if (l < 8) return EINVAL; l -= 8; - if (p[0] > 191 || p[1] > 31 || p[2] > 191 || p[3] > 31 || + if (p[0] > 191 || p[1] > 31 || p[2] > 192 || p[3] > 32 || p[0] + p[2] > 192 || p[1] + p[3] > 32 || (p[2] * p[3]) > l) return -EFAULT; -- 2.34.1