svn commit: r271756 - head/sys/dev/vt

[Jean-Sebastien Pedron]

Author: dumbbell
Date: Thu Sep 18 12:20:19 2014
New Revision: 271756
URL: http://svnweb.freebsd.org/changeset/base/271756

Log:
  vt(4): Fix out-of-bounds array access in VT_ACTIVATE ioctl handling
  
  CID:		1229964
  MFC after:	3 days

Modified:
  head/sys/dev/vt/vt_core.c

Modified: head/sys/dev/vt/vt_core.c
==============================================================================
--- head/sys/dev/vt/vt_core.c	Thu Sep 18 11:52:28 2014	(r271755)
+++ head/sys/dev/vt/vt_core.c	Thu Sep 18 12:20:19 2014	(r271756)
@@ -2131,7 +2131,7 @@ skip_thunk:
 		win = *(int *)data - 1;
 		DPRINTF(5, "%s%d: VT_ACTIVATE ttyv%d ", SC_DRIVER_NAME,
 		    VT_UNIT(vw), win);
-		if ((win > VT_MAXWINDOWS) || (win < 0))
+		if ((win >= VT_MAXWINDOWS) || (win < 0))
 			return (EINVAL);
 		return (vt_proc_window_switch(vd->vd_windows[win]));
 	}