DragonFlyBSD Kernel Audit
DF-1702 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/misc/syscons/scmouse.c b/sys/dev/misc/syscons/scmouse.c
--- a/sys/dev/misc/syscons/scmouse.c
+++ b/sys/dev/misc/syscons/scmouse.c
@@ -84,12 +84,12 @@
     u_char *p;
 
     if ((cut_buffer == NULL)
-	|| (cut_buffer_size < scp->xsize * scp->ysize + 1)) {
+	|| (cut_buffer_size < (scp->xsize + 1) * scp->ysize + 1)) {
 	p = cut_buffer;
 	cut_buffer = NULL;
 	if (p != NULL)
 	    kfree(p, M_SYSCONS);
-	cut_buffer_size = scp->xsize * scp->ysize + 1;
+	cut_buffer_size = (scp->xsize + 1) * scp->ysize + 1;
 	p = kmalloc(cut_buffer_size, M_SYSCONS, (wait) ? M_WAITOK : M_NOWAIT);
 	if (p != NULL)
 	    p[0] = '\0';