From 50732b3de89b87c49e7c73f8c45036b53e8424b1 Mon Sep 17 00:00:00 2001
From: gordon <gordon@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f>
Date: Wed, 4 Apr 2018 05:33:56 +0000
Subject: [PATCH] Fix vt console memory disclosure. [SA-18:04.vt]

Bump newvers.sh and UPDATING for today's patches.

Submitted by:	emaste
Reported by:	Dr Silvio Cesare of InfoSect
Approved by:	so
Security:	CVE-2018-6917
Security:	FreeBSD-SA-18:04.vt
Sponsored by:	The FreeBSD Foundation


git-svn-id: svn://svn.freebsd.org/base/releng/10.3@331984 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
---
 UPDATING             | 13 +++++++++++++
 sys/conf/newvers.sh  |  2 +-
 sys/dev/vt/vt_font.c |  4 +++-
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/UPDATING b/UPDATING
index ee53982a5..18ad877b2 100644
--- a/UPDATING
+++ b/UPDATING
@@ -16,6 +16,19 @@ from older versions of FreeBSD, try WITHOUT_CLANG to bootstrap to the tip of
 stable/10, and then rebuild without this option. The bootstrap process from
 older version of current is a bit fragile.
 
+20180404	p29	FreeBSD-SA-18:04.vt
+			FreeBSD-SA-18:05.ipsec
+			FreeBSD-EN-18:03.tzdata
+			FreeBSD-EN-18:04.mem
+
+	Fix vt console memory disclosure. [SA-18:04.vt]
+
+	Fix ipsec crash or denial of service. [SA-18:05.ipsec]
+
+	Update timezone database information. [EN-18:03.tzdata]
+
+	Fix multiple small kernel memory disclosures. [EN-18:04.mem]
+
 20180308	p28	FreeBSD-SA-18:01.ipsec [revised]
 
 	Fix ipsec validation and use-after-free.
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index be0f7991b..b105b280c 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="10.3"
-BRANCH="RELEASE-p28"
+BRANCH="RELEASE-p29"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi
diff --git a/sys/dev/vt/vt_font.c b/sys/dev/vt/vt_font.c
index 4c369c68b..1e65e70cf 100644
--- a/sys/dev/vt/vt_font.c
+++ b/sys/dev/vt/vt_font.c
@@ -42,6 +42,7 @@ static MALLOC_DEFINE(M_VTFONT, "vtfont", "vt font");
 
 /* Some limits to prevent abnormal fonts from being loaded. */
 #define	VTFONT_MAXMAPPINGS	65536
+#define	VTFONT_MAXGLYPHS	131072
 #define	VTFONT_MAXGLYPHSIZE	2097152
 #define	VTFONT_MAXDIMENSION	128
 
@@ -171,7 +172,8 @@ vtfont_load(vfnt_t *f, struct vt_font **ret)
 	/* Make sure the dimensions are valid. */
 	if (f->width < 1 || f->height < 1)
 		return (EINVAL);
-	if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION)
+	if (f->width > VTFONT_MAXDIMENSION || f->height > VTFONT_MAXDIMENSION ||
+	    f->glyph_count > VTFONT_MAXGLYPHS)
 		return (E2BIG);
 
 	/* Not too many mappings. */
-- 
2.42.0