diff options
author | Antonino A. Daplas <adaplas@gmail.com> | 2007-07-17 04:05:37 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-07-17 10:23:12 -0700 |
commit | 24fc72239ab5a2d26ebdd4f6950539e6120d1a54 (patch) | |
tree | 4725301358a10bfd94e3616efbe519c5ef107cff /drivers/video | |
parent | 9058be43cf9f32b6c636aa6954b4f1a6b22098f6 (diff) | |
download | linux-24fc72239ab5a2d26ebdd4f6950539e6120d1a54.tar.gz linux-24fc72239ab5a2d26ebdd4f6950539e6120d1a54.tar.bz2 linux-24fc72239ab5a2d26ebdd4f6950539e6120d1a54.zip |
macfb: fix pseudo_palette size and overrun
- the pseudo_palette is only 16 elements long.
- do not write to the pseudo_palette if regno (array index) is more than 15.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/video')
-rw-r--r-- | drivers/video/macfb.c | 93 |
1 files changed, 50 insertions, 43 deletions
diff --git a/drivers/video/macfb.c b/drivers/video/macfb.c index f7d647dda978..aa8c714d6245 100644 --- a/drivers/video/macfb.c +++ b/drivers/video/macfb.c @@ -170,7 +170,7 @@ static struct fb_fix_screeninfo macfb_fix = { }; static struct fb_info fb_info; -static u32 pseudo_palette[17]; +static u32 pseudo_palette[16]; static int inverse = 0; static int vidtest = 0; @@ -529,56 +529,63 @@ static int macfb_setcolreg(unsigned regno, unsigned red, unsigned green, if (regno >= fb_info->cmap.len) return 1; - switch (fb_info->var.bits_per_pixel) { - case 1: - /* We shouldn't get here */ - break; - case 2: - case 4: - case 8: - if (macfb_setpalette) - macfb_setpalette(regno, red, green, blue, fb_info); - else - return 1; - break; - case 16: - if (fb_info->var.red.offset == 10) { - /* 1:5:5:5 */ - ((u32*) (fb_info->pseudo_palette))[regno] = + if (fb_info->var.bits_per_pixel <= 8) { + switch (fb_info->var.bits_per_pixel) { + case 1: + /* We shouldn't get here */ + break; + case 2: + case 4: + case 8: + if (macfb_setpalette) + macfb_setpalette(regno, red, green, blue, + fb_info); + else + return 1; + break; + } + } else if (regno < 16) { + switch (fb_info->var.bits_per_pixel) { + case 16: + if (fb_info->var.red.offset == 10) { + /* 1:5:5:5 */ + ((u32*) (fb_info->pseudo_palette))[regno] = ((red & 0xf800) >> 1) | ((green & 0xf800) >> 6) | ((blue & 0xf800) >> 11) | ((transp != 0) << 15); - } else { - /* 0:5:6:5 */ - ((u32*) (fb_info->pseudo_palette))[regno] = + } else { + /* 0:5:6:5 */ + ((u32*) (fb_info->pseudo_palette))[regno] = ((red & 0xf800) ) | ((green & 0xfc00) >> 5) | ((blue & 0xf800) >> 11); + } + break; + /* I'm pretty sure that one or the other of these + doesn't exist on 68k Macs */ + case 24: + red >>= 8; + green >>= 8; + blue >>= 8; + ((u32 *)(fb_info->pseudo_palette))[regno] = + (red << fb_info->var.red.offset) | + (green << fb_info->var.green.offset) | + (blue << fb_info->var.blue.offset); + break; + case 32: + red >>= 8; + green >>= 8; + blue >>= 8; + ((u32 *)(fb_info->pseudo_palette))[regno] = + (red << fb_info->var.red.offset) | + (green << fb_info->var.green.offset) | + (blue << fb_info->var.blue.offset); + break; } - break; - /* I'm pretty sure that one or the other of these - doesn't exist on 68k Macs */ - case 24: - red >>= 8; - green >>= 8; - blue >>= 8; - ((u32 *)(fb_info->pseudo_palette))[regno] = - (red << fb_info->var.red.offset) | - (green << fb_info->var.green.offset) | - (blue << fb_info->var.blue.offset); - break; - case 32: - red >>= 8; - green >>= 8; - blue >>= 8; - ((u32 *)(fb_info->pseudo_palette))[regno] = - (red << fb_info->var.red.offset) | - (green << fb_info->var.green.offset) | - (blue << fb_info->var.blue.offset); - break; - } - return 0; + } + + return 0; } static struct fb_ops macfb_ops = { |