untrusted comment: signature from openbsd 5.9 base secret key RWQJVNompF3pwQJgnjrPLUEn2gin3oCINiHeB9FZ7fNH6yEvWa+w8tU7NuyO+o32aHbFiOOSaZtQrFplCRb33+LtdDNgOYBG2wI= OpenBSD 5.9 errata 26, Sep 17, 2016: Limit the number of wscons fonts that can be loaded into the kernel. Apply by doing: signify -Vep /etc/signify/openbsd-59-base.pub -x 026_wsfont.patch.sig \ -m - | (cd /usr/src && patch -p0) And then rebuild and install a kernel: cd /usr/src/sys/arch/`machine`/conf KK=`sysctl -n kern.osversion | cut -d# -f1` config $KK cd ../compile/$KK make make install Index: sys/dev/wscons/wsconsio.h =================================================================== RCS file: /cvs/src/sys/dev/wscons/wsconsio.h,v retrieving revision 1.73 retrieving revision 1.73.2.1 diff -u -p -r1.73 -r1.73.2.1 --- sys/dev/wscons/wsconsio.h 12 Dec 2015 12:30:18 -0000 1.73 +++ sys/dev/wscons/wsconsio.h 16 Sep 2016 15:01:05 -0000 1.73.2.1 @@ -404,6 +404,7 @@ struct wsdisplay_cursor { struct wsdisplay_font { char name[WSFONT_NAME_SIZE]; int index; +#define WSDISPLAY_MAXFONTCOUNT 8 int firstchar, numchars; int encoding; #define WSDISPLAY_FONTENC_ISO 0 Index: sys/dev/wsfont/wsfont.c =================================================================== RCS file: /cvs/src/sys/dev/wsfont/wsfont.c,v retrieving revision 1.42 retrieving revision 1.42.2.1 diff -u -p -r1.42 -r1.42.2.1 --- sys/dev/wsfont/wsfont.c 13 Sep 2015 16:44:30 -0000 1.42 +++ sys/dev/wsfont/wsfont.c 16 Sep 2016 15:01:05 -0000 1.42.2.1 @@ -450,13 +450,21 @@ wsfont_add(struct wsdisplay_font *font, { static int cookiegen = 666; struct font *ent; - int s; + int s, fontc = 0; s = splhigh(); /* Don't allow exact duplicates */ if (wsfont_find(font->name, font->fontwidth, font->fontheight, font->stride) >= 0) { + splx(s); + return (-1); + } + + TAILQ_FOREACH(ent, &fontlist, chain) + fontc++; + + if (fontc >= WSDISPLAY_MAXFONTCOUNT) { splx(s); return (-1); }