Index: kern/uipc_syscalls.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/uipc_syscalls.c,v
retrieving revision 1.122
diff -u -r1.122 uipc_syscalls.c
--- kern/uipc_syscalls.c	1 Aug 2002 17:47:56 -0000	1.122
+++ kern/uipc_syscalls.c	9 Aug 2002 05:46:39 -0000
@@ -256,6 +256,8 @@
 		error = copyin(uap->anamelen, &namelen, sizeof (namelen));
 		if(error)
 			goto done2;
+		if (namelen < 0)
+			return (EINVAL);
 	}
 	error = fgetsock(td, uap->s, &head, &fflag);
 	if (error)
Index: i386/isa/vesa.c
===================================================================
RCS file: /home/ncvs/src/sys/i386/isa/vesa.c,v
retrieving revision 1.36
diff -u -r1.36 vesa.c
--- i386/isa/vesa.c	18 Sep 2001 22:52:42 -0000	1.36
+++ i386/isa/vesa.c	9 Aug 2002 05:46:42 -0000
@@ -1330,7 +1330,9 @@
 	int bits;
 	int error;
 
-	if ((base < 0) || (base >= 256) || (base + count > 256))
+	if ((base < 0) || (base >= 256) || (count < 0) || (count > 256))
+		return 1;
+	if ((base + count) > 256)
 		return 1;
 	if (!(vesa_adp_info->v_flags & V_DAC8) || !VESA_MODE(adp->va_mode))
 		return 1;