sisfb: fix pseudo_palette array size and overrun
- the pseudo_palette is only 16 elements long. - do not write to the pseudo_palette if regno (array index) is more than 15. Signed-off-by: Antonino Daplas <adaplas@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Родитель
c312f97df6
Коммит
000d5335c6
|
@ -479,7 +479,7 @@ struct sis_video_info {
|
|||
struct fb_var_screeninfo default_var;
|
||||
|
||||
struct fb_fix_screeninfo sisfb_fix;
|
||||
u32 pseudo_palette[17];
|
||||
u32 pseudo_palette[16];
|
||||
|
||||
struct sisfb_monitor {
|
||||
u16 hmin;
|
||||
|
|
|
@ -1405,12 +1405,18 @@ sisfb_setcolreg(unsigned regno, unsigned red, unsigned green, unsigned blue,
|
|||
}
|
||||
break;
|
||||
case 16:
|
||||
if (regno >= 16)
|
||||
break;
|
||||
|
||||
((u32 *)(info->pseudo_palette))[regno] =
|
||||
(red & 0xf800) |
|
||||
((green & 0xfc00) >> 5) |
|
||||
((blue & 0xf800) >> 11);
|
||||
break;
|
||||
case 32:
|
||||
if (regno >= 16)
|
||||
break;
|
||||
|
||||
red >>= 8;
|
||||
green >>= 8;
|
||||
blue >>= 8;
|
||||
|
|
Загрузка…
Ссылка в новой задаче