DragonFlyBSD Kernel Audit
DF-1858 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/dev/video/fb/bmp/splash_bmp.c b/sys/dev/video/fb/bmp/splash_bmp.c
--- a/sys/dev/video/fb/bmp/splash_bmp.c
+++ b/sys/dev/video/fb/bmp/splash_bmp.c
@@ -255,9 +255,13 @@
     /*
      * range check to avoid explosions
      */
-    if ((x < 0) || (x >= info->swidth) || (y < 0) || (y >= info->sheight))
+    if ((x < 0) || (x >= info->swidth) || (y < 0) ||
+        (y >= info->sheight) || (y >= info->height))
 	return;
     
+    if (info->sheight < info->height)
+    	return;
+    
     lwkt_gettoken(&vga_token);
     /* 
      * calculate offset into video memory;