svn commit: r265442 - head/sys/dev/vt

[Matthew Fleming]

On Tue, May 6, 2014 at 6:52 AM, Aleksandr Rybalko <ray at freebsd.org> wrote:
> Author: ray
> Date: Tue May  6 13:52:13 2014
> New Revision: 265442
> URL: http://svnweb.freebsd.org/changeset/base/265442
>
> Log:
>   Implement KDMKTONE ioctl.
>
>   Submitted by: Matthew D.Fuller <fullermd at over-yonder.net> (original version)
>   MFC:          7 days
>   PR:           kern/189170
>
>   Sponsored by: The FreeBSD Foundation
>
> Modified:
>   head/sys/dev/vt/vt_core.c
>
> Modified: head/sys/dev/vt/vt_core.c
> ==============================================================================
> --- head/sys/dev/vt/vt_core.c   Tue May  6 13:46:36 2014        (r265441)
> +++ head/sys/dev/vt/vt_core.c   Tue May  6 13:52:13 2014        (r265442)
> @@ -1732,9 +1732,17 @@ skip_thunk:
>                 td->td_frame->tf_rflags &= ~PSL_IOPL;
>  #endif
>                 return (0);
> -       case KDMKTONE:          /* sound the bell */
> -               /* TODO */
> +       case KDMKTONE: {        /* sound the bell */
> +               int freq, period;
> +
> +               freq = 1193182 / ((*(int*)data) & 0xffff);

This data comes from a user and can't be trusted.  This is a potential
divide-by-zero.

> +               period = (((*(int*)data)>>16) & 0xffff) * hz / 1000;

This is signed shift which I can't recall if it's well-defined if the
number is negative.  Using u_int would definitely be defined.

Thanks,
matthew