diff options
| author | Gordon Tetlow <gordon@FreeBSD.org> | 2018-04-04 05:33:56 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2018-04-04 05:33:56 +0000 |
| commit | a500153f5edf1c468350f1f60ca54f0c3a9dda7b (patch) | |
| tree | 796cc2d9bb7c3f41d9d9714929ccd8ef12fb546b | |
| parent | 139e67194b734663843bad9ee59676d9d440e109 (diff) | |
| download | src-test2-a500153f5edf1c468350f1f60ca54f0c3a9dda7b.tar.gz src-test2-a500153f5edf1c468350f1f60ca54f0c3a9dda7b.zip | |
Notes
| -rw-r--r-- | UPDATING | 13 | ||||
| -rw-r--r-- | sys/conf/newvers.sh | 2 | ||||
| -rw-r--r-- | sys/dev/vt/vt_font.c | 4 |
3 files changed, 17 insertions, 2 deletions
@@ -16,6 +16,19 @@ from older versions of FreeBSD, try WITHOUT_CLANG to bootstrap to the tip of stable/10, and then rebuild without this option. The bootstrap process from older version of current is a bit fragile. +20180404 p29 FreeBSD-SA-18:04.vt + FreeBSD-SA-18:05.ipsec + FreeBSD-EN-18:03.tzdata + FreeBSD-EN-18:04.mem + + Fix vt console memory disclosure. [SA-18:04.vt] + + Fix ipsec crash or denial of service. [SA-18:05.ipsec] + + Update timezone database information. [EN-18:03.tzdata] + + Fix multiple small kernel memory disclosures. [EN-18:04.mem] + 20180308 p28 FreeBSD-SA-18:01.ipsec [revised] Fix ipsec validation and use-after-free. diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh index be0f7991b05b..b105b280c66c 100644 --- a/sys/conf/newvers.sh +++ b/sys/conf/newvers.sh @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="10.3" -BRANCH="RELEASE-p28" +BRANCH="RELEASE-p29" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi diff --git a/sys/dev/vt/vt_font.c b/sys/dev/vt/vt_font.c index 4c369c68bdb2..1e65e70cfe2c 100644 --- a/sys/dev/vt/vt_font.c +++ b/sys/dev/vt/vt_font.c @@ -42,6 +42,7 @@ static MALLOC_DEFINE(M_VTFONT, "vtfont", "vt font"); /* Some limits to prevent abnormal fonts from being loaded. */ #define VTFONT_MAXMAPPINGS 65536 +#define VTFONT_MAXGLYPHS 131072 #define VTFONT_MAXGLYPHSIZE 2097152 #define VTFONT_MAXDIMENSION 128 @@ -171,7 +172,8 @@ vtfont_load(vfnt_t *f, struct vt_font **ret) /* Make sure the dimensions are valid. */ if (f->width < 1 || f->height < 1) return (EINVAL); - if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION) + if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION || + f->glyph_count > VTFONT_MAXGLYPHS) return (E2BIG); /* Not too many mappings. */ |