⬢ DragonFlyBSD Kernel Audit
DF-5194 / fix.diff
← back to finding ↓ download raw
--- a/sys/dev/misc/syscons/snake/snake_saver.c
+++ b/sys/dev/misc/syscons/snake/snake_saver.c
@@ -103,6 +103,15 @@ snake_saver(video_adapter_t *adp, int blank)
 		    (krandom() % 20) == 0)
 			diry = -diry;
 		savs[0] += dirx + diry;
+		/*
+		 * DF-5194: sc_vtb_putc() is completely unchecked, so the
+		 * bounce arithmetic above is the only thing confining the
+		 * snake.  If the geometry changed under us (or a degenerate
+		 * geometry such as ysize==1 broke the wall conditions -- C
+		 * truncating division can never re-trigger them from an
+		 * out-of-range position), reinitialize instead of walking
+		 * off the screen buffer and, eventually, off the video
+		 * window into adjacent DMAP'd memory.
+		 */
+		if (savs[0] < 0 || savs[0] >= scp->xsize * scp->ysize) {
+			blanked = 0;	/* reinitialize on the next tick */
+			return (0);
+		}
 		for (f=messagelen-1; f>=0; f--)
 			sc_vtb_putc(&scp->scr, savs[f], sc->scr_map[save[f]],
 				    (FG_LIGHTGREY | BG_BLACK) << 8);