diff options
| author | Antonino A. Daplas <adaplas@gmail.com> | 2007-07-17 13:05:44 +0200 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-07-17 19:23:13 +0200 |
| commit | 000d5335c6e7f5dbcd849b62b4be7ae005aa6974 (patch) | |
| tree | af6894791cc9fbd7dd38ac2ec0026be0f1a75a42 /drivers/video/sis | |
| parent | intelfb: the pseudo_palette is only 16 elements long (diff) | |
| download | linux-000d5335c6e7f5dbcd849b62b4be7ae005aa6974.tar.xz linux-000d5335c6e7f5dbcd849b62b4be7ae005aa6974.zip | |
sisfb: fix pseudo_palette array size and overrun
- the pseudo_palette is only 16 elements long.
- do not write to the pseudo_palette if regno (array index) is more than 15.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/video/sis')
| -rw-r--r-- | drivers/video/sis/sis.h | 2 | ||||
| -rw-r--r-- | drivers/video/sis/sis_main.c | 6 |
2 files changed, 7 insertions, 1 deletions
diff --git a/drivers/video/sis/sis.h b/drivers/video/sis/sis.h index d5e2d9c27847..d53bf6945f0c 100644 --- a/drivers/video/sis/sis.h +++ b/drivers/video/sis/sis.h @@ -479,7 +479,7 @@ struct sis_video_info { struct fb_var_screeninfo default_var; struct fb_fix_screeninfo sisfb_fix; - u32 pseudo_palette[17]; + u32 pseudo_palette[16]; struct sisfb_monitor { u16 hmin; diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c index 93d07ef85276..e8ccace01252 100644 --- a/drivers/video/sis/sis_main.c +++ b/drivers/video/sis/sis_main.c @@ -1405,12 +1405,18 @@ sisfb_setcolreg(unsigned regno, unsigned red, unsigned green, unsigned blue, } break; case 16: + if (regno >= 16) + break; + ((u32 *)(info->pseudo_palette))[regno] = (red & 0xf800) | ((green & 0xfc00) >> 5) | ((blue & 0xf800) >> 11); break; case 32: + if (regno >= 16) + break; + red >>= 8; green >>= 8; blue >>= 8; |