untrusted comment: verify with openbsd-65-base.pub
RWSZaRmt1LEQT8gh/KmURKV6BkIwGDhe7xETLy5YtKaudntSP5lhwXE2Rj0bORr987D0/SoYshaudwcIChbPGsJhvLN9SZ8hQQA=
OpenBSD 6.5 errata 037, May 13, 2020:
An out-of-bounds index access in wscons(4) can cause a kernel crash.
Apply by doing:
signify -Vep /etc/signify/openbsd-65-base.pub -x 037_wscons.patch.sig \
-m - | (cd /usr/src && patch -p0)
And then rebuild and install a new kernel:
KK=`sysctl -n kern.osversion | cut -d# -f1`
cd /usr/src/sys/arch/`machine`/compile/$KK
make obj
make config
make
make install
Index: sys/dev/wscons/wsdisplay.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsdisplay.c,v
retrieving revision 1.131
diff -u -p -r1.131 wsdisplay.c
--- sys/dev/wscons/wsdisplay.c 19 Feb 2018 08:59:52 -0000 1.131
+++ sys/dev/wscons/wsdisplay.c 10 May 2020 20:51:38 -0000
@@ -1242,7 +1242,7 @@ wsdisplay_internal_ioctl(struct wsdispla
case WSDISPLAYIO_GETSCREENTYPE:
#define d ((struct wsdisplay_screentype *)data)
- if (d->idx >= sc->sc_scrdata->nscreens)
+ if (d->idx < 0 || d->idx >= sc->sc_scrdata->nscreens)
return(EINVAL);
d->nidx = sc->sc_scrdata->nscreens;
Index: sys/dev/wscons/wsemulconf.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsemulconf.c,v
retrieving revision 1.9
diff -u -p -r1.9 wsemulconf.c
--- sys/dev/wscons/wsemulconf.c 14 Mar 2015 03:38:50 -0000 1.9
+++ sys/dev/wscons/wsemulconf.c 10 May 2020 20:51:38 -0000
@@ -78,7 +78,7 @@ wsemul_pick(const char *name)
const char *
wsemul_getname(int idx)
{
- if (idx >= nitems(wsemul_conf) - 1)
+ if (idx < 0 || idx >= nitems(wsemul_conf) - 1)
return (NULL);
return (wsemul_conf[idx]->name);
}