summaryrefslogtreecommitdiffstats
path: root/drivers/video
diff options
context:
space:
mode:
authorAntonino A. Daplas <adaplas@gmail.com>2007-07-17 04:05:44 -0700
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-07-17 10:23:13 -0700
commit000d5335c6e7f5dbcd849b62b4be7ae005aa6974 (patch)
treeaf6894791cc9fbd7dd38ac2ec0026be0f1a75a42 /drivers/video
parentc312f97df65bf38a8e7f664b76154639f593775d (diff)
downloadlinux-000d5335c6e7f5dbcd849b62b4be7ae005aa6974.tar.gz
linux-000d5335c6e7f5dbcd849b62b4be7ae005aa6974.tar.bz2
linux-000d5335c6e7f5dbcd849b62b4be7ae005aa6974.zip
sisfb: fix pseudo_palette array size and overrun
- the pseudo_palette is only 16 elements long. - do not write to the pseudo_palette if regno (array index) is more than 15. Signed-off-by: Antonino Daplas <adaplas@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/video')
-rw-r--r--drivers/video/sis/sis.h2
-rw-r--r--drivers/video/sis/sis_main.c6
2 files changed, 7 insertions, 1 deletions
diff --git a/drivers/video/sis/sis.h b/drivers/video/sis/sis.h
index d5e2d9c27847..d53bf6945f0c 100644
--- a/drivers/video/sis/sis.h
+++ b/drivers/video/sis/sis.h
@@ -479,7 +479,7 @@ struct sis_video_info {
struct fb_var_screeninfo default_var;
struct fb_fix_screeninfo sisfb_fix;
- u32 pseudo_palette[17];
+ u32 pseudo_palette[16];
struct sisfb_monitor {
u16 hmin;
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index 93d07ef85276..e8ccace01252 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -1405,12 +1405,18 @@ sisfb_setcolreg(unsigned regno, unsigned red, unsigned green, unsigned blue,
}
break;
case 16:
+ if (regno >= 16)
+ break;
+
((u32 *)(info->pseudo_palette))[regno] =
(red & 0xf800) |
((green & 0xfc00) >> 5) |
((blue & 0xf800) >> 11);
break;
case 32:
+ if (regno >= 16)
+ break;
+
red >>= 8;
green >>= 8;
blue >>= 8;