DragonFlyBSD Kernel Audit
DF-1825 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/misc/evdev/evdev_mt.c b/sys/dev/misc/evdev/evdev_mt.c
--- a/sys/dev/misc/evdev/evdev_mt.c
+++ b/sys/dev/misc/evdev/evdev_mt.c
@@ -417,7 +417,10 @@
 	case EV_SYN:
 		if (code == SYN_MT_REPORT) {
 			/* MT protocol type A support */
-			KASSERT(mt->type_a, ("Not a MT type A protocol"));
+			if (!mt->type_a)
+				return (false);
+			if (mt->match_slot < 0 || mt->match_slot > MAXIMAL_MT_SLOT(evdev))
+				return (false);
 			mt->match_frame |= 1U << mt->match_slot;
 			mt->match_slot++;
 			return (true);