evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

neofb: Fix pseudo_palette array overrun in neofb_setcolreg

Browse source 
The pseudo_palette has room for 16 entries only, but in truecolor mode, it
attempts to write 256.

Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Acked-by: Tero Roponen <teanropo@jyu.fi>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Antonino A. Daplas 2007-05-31 14:04:57 +08:00 • committed by Linus Torvalds
parent 3f0a6766e0
commit a2b7d2e97e
1 changed files with 16 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/video/neofb.c
View file

@ -1286,14 +1286,14 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
if (regno >= fb->cmap.len || regno > 255) if (regno >= fb->cmap.len || regno > 255)
return -EINVAL; return -EINVAL;
switch (fb->var.bits_per_pixel) { if (fb->var.bits_per_pixel <= 8) {
case 8:
outb(regno, 0x3c8); outb(regno, 0x3c8);
outb(red >> 10, 0x3c9); outb(red >> 10, 0x3c9);
outb(green >> 10, 0x3c9); outb(green >> 10, 0x3c9);
outb(blue >> 10, 0x3c9); outb(blue >> 10, 0x3c9);
break; } else if (regno < 16) {
switch (fb->var.bits_per_pixel) {
case 16: case 16:
((u32 *) fb->pseudo_palette)[regno] = ((u32 *) fb->pseudo_palette)[regno] =
((red & 0xf800)) | ((green & 0xfc00) >> 5) | ((red & 0xf800)) | ((green & 0xfc00) >> 5) |
@ -1314,6 +1314,8 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
default: default:
return 1; return 1;
} }
}
return 0; return 0;
} }