--- a/sys/dev/misc/syscons/snake/snake_saver.c +++ b/sys/dev/misc/syscons/snake/snake_saver.c @@ -103,6 +103,15 @@ snake_saver(video_adapter_t *adp, int blank) (krandom() % 20) == 0) diry = -diry; savs[0] += dirx + diry; + /* + * DF-5194: sc_vtb_putc() is completely unchecked, so the + * bounce arithmetic above is the only thing confining the + * snake. If the geometry changed under us (or a degenerate + * geometry such as ysize==1 broke the wall conditions -- C + * truncating division can never re-trigger them from an + * out-of-range position), reinitialize instead of walking + * off the screen buffer and, eventually, off the video + * window into adjacent DMAP'd memory. + */ + if (savs[0] < 0 || savs[0] >= scp->xsize * scp->ysize) { + blanked = 0; /* reinitialize on the next tick */ + return (0); + } for (f=messagelen-1; f>=0; f--) sc_vtb_putc(&scp->scr, savs[f], sc->scr_map[save[f]], (FG_LIGHTGREY | BG_BLACK) << 8);