diff options
| author | Antonino A. Daplas <adaplas@gmail.com> | 2006-03-11 03:27:26 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-03-11 09:19:35 -0800 |
| commit | d301524772be3eef5fae1bcd5ca76fac69bb3b6e (patch) | |
| tree | d2d26317432a5726a7aa6192d510247990dfd7c5 | |
| parent | 8d57f2210e72e0168734bd1503b9e52a71f53d65 (diff) | |
| download | linux-d301524772be3eef5fae1bcd5ca76fac69bb3b6e.tar.gz linux-d301524772be3eef5fae1bcd5ca76fac69bb3b6e.tar.bz2 linux-d301524772be3eef5fae1bcd5ca76fac69bb3b6e.zip | |
[PATCH] intelfb: Fix buffer overrun
The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will
attempt to write more.
Coverity Bug 558
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | drivers/video/intelfb/intelfbdrv.c | 50 |
1 files changed, 26 insertions, 24 deletions
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c index 6b8bd3cdf9c0..995b47c165a7 100644 --- a/drivers/video/intelfb/intelfbdrv.c +++ b/drivers/video/intelfb/intelfbdrv.c @@ -1333,33 +1333,35 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green, if (regno > 255) return 1; - switch (dinfo->depth) { - case 8: - { - red >>= 8; - green >>= 8; - blue >>= 8; + if (dinfo->depth == 8) { + red >>= 8; + green >>= 8; + blue >>= 8; + + intelfbhw_setcolreg(dinfo, regno, red, green, blue, + transp); + } - intelfbhw_setcolreg(dinfo, regno, red, green, blue, - transp); + if (regno < 16) { + switch (dinfo->depth) { + case 15: + dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) | + ((green & 0xf800) >> 6) | + ((blue & 0xf800) >> 11); + break; + case 16: + dinfo->pseudo_palette[regno] = (red & 0xf800) | + ((green & 0xfc00) >> 5) | + ((blue & 0xf800) >> 11); + break; + case 24: + dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) | + (green & 0xff00) | + ((blue & 0xff00) >> 8); + break; } - break; - case 15: - dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) | - ((green & 0xf800) >> 6) | - ((blue & 0xf800) >> 11); - break; - case 16: - dinfo->pseudo_palette[regno] = (red & 0xf800) | - ((green & 0xfc00) >> 5) | - ((blue & 0xf800) >> 11); - break; - case 24: - dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) | - (green & 0xff00) | - ((blue & 0xff00) >> 8); - break; } + return 0; } |