From 000d5335c6e7f5dbcd849b62b4be7ae005aa6974 Mon Sep 17 00:00:00 2001 From: "Antonino A. Daplas" Date: Tue, 17 Jul 2007 04:05:44 -0700 Subject: sisfb: fix pseudo_palette array size and overrun - the pseudo_palette is only 16 elements long. - do not write to the pseudo_palette if regno (array index) is more than 15. Signed-off-by: Antonino Daplas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/video/sis/sis.h | 2 +- drivers/video/sis/sis_main.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) (limited to 'drivers/video') diff --git a/drivers/video/sis/sis.h b/drivers/video/sis/sis.h index d5e2d9c2784..d53bf6945f0 100644 --- a/drivers/video/sis/sis.h +++ b/drivers/video/sis/sis.h @@ -479,7 +479,7 @@ struct sis_video_info { struct fb_var_screeninfo default_var; struct fb_fix_screeninfo sisfb_fix; - u32 pseudo_palette[17]; + u32 pseudo_palette[16]; struct sisfb_monitor { u16 hmin; diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c index 93d07ef8527..e8ccace0125 100644 --- a/drivers/video/sis/sis_main.c +++ b/drivers/video/sis/sis_main.c @@ -1405,12 +1405,18 @@ sisfb_setcolreg(unsigned regno, unsigned red, unsigned green, unsigned blue, } break; case 16: + if (regno >= 16) + break; + ((u32 *)(info->pseudo_palette))[regno] = (red & 0xf800) | ((green & 0xfc00) >> 5) | ((blue & 0xf800) >> 11); break; case 32: + if (regno >= 16) + break; + red >>= 8; green >>= 8; blue >>= 8; -- cgit v1.2.3