DF-1702 / fix.diff
diff --git a/sys/dev/misc/syscons/scmouse.c b/sys/dev/misc/syscons/scmouse.c --- a/sys/dev/misc/syscons/scmouse.c +++ b/sys/dev/misc/syscons/scmouse.c @@ -84,12 +84,12 @@ u_char *p; if ((cut_buffer == NULL) - || (cut_buffer_size < scp->xsize * scp->ysize + 1)) { + || (cut_buffer_size < (scp->xsize + 1) * scp->ysize + 1)) { p = cut_buffer; cut_buffer = NULL; if (p != NULL) kfree(p, M_SYSCONS); - cut_buffer_size = scp->xsize * scp->ysize + 1; + cut_buffer_size = (scp->xsize + 1) * scp->ysize + 1; p = kmalloc(cut_buffer_size, M_SYSCONS, (wait) ? M_WAITOK : M_NOWAIT); if (p != NULL) p[0] = '\0'; |