diff options
| author | Antonino A. Daplas <adaplas@gmail.com> | 2007-07-17 04:05:35 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-07-17 10:23:12 -0700 |
| commit | 7592181005261c3d90398375ab6922f56cdd2bad (patch) | |
| tree | 9ca5d040ec5bd2258553af8e3f2ef8d14e5db316 /drivers/video/cyblafb.c | |
| parent | 11494543a5775b4764d0172084092715a533a8ce (diff) | |
| download | linux-7592181005261c3d90398375ab6922f56cdd2bad.tar.gz linux-7592181005261c3d90398375ab6922f56cdd2bad.tar.bz2 linux-7592181005261c3d90398375ab6922f56cdd2bad.zip | |
cyblafb: fix pseudo_palette array overrun in setcolreg
The pseudo_palette has only 16 elements. Do not write if regno (the array
index) is more than 15.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/video/cyblafb.c')
| -rw-r--r-- | drivers/video/cyblafb.c | 21 |
1 files changed, 12 insertions, 9 deletions
diff --git a/drivers/video/cyblafb.c b/drivers/video/cyblafb.c index 94a66c2d2cf5..e23324d10be2 100644 --- a/drivers/video/cyblafb.c +++ b/drivers/video/cyblafb.c @@ -1068,15 +1068,18 @@ static int cyblafb_setcolreg(unsigned regno, unsigned red, unsigned green, out8(0x3C9, green >> 10); out8(0x3C9, blue >> 10); - } else if (bpp == 16) // RGB 565 - ((u32 *) info->pseudo_palette)[regno] = - (red & 0xF800) | - ((green & 0xFC00) >> 5) | ((blue & 0xF800) >> 11); - else if (bpp == 32) // ARGB 8888 - ((u32 *) info->pseudo_palette)[regno] = - ((transp & 0xFF00) << 16) | - ((red & 0xFF00) << 8) | - ((green & 0xFF00)) | ((blue & 0xFF00) >> 8); + } else if (regno < 16) { + if (bpp == 16) // RGB 565 + ((u32 *) info->pseudo_palette)[regno] = + (red & 0xF800) | + ((green & 0xFC00) >> 5) | + ((blue & 0xF800) >> 11); + else if (bpp == 32) // ARGB 8888 + ((u32 *) info->pseudo_palette)[regno] = + ((transp & 0xFF00) << 16) | + ((red & 0xFF00) << 8) | + ((green & 0xFF00)) | ((blue & 0xFF00) >> 8); + } return 0; } |