aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAntonino A. Daplas <adaplas@gmail.com>2007-06-05 19:34:59 +0800
committerChris Wright <chrisw@sous-sol.org>2007-06-11 11:36:49 -0700
commit402d9a26212b35e21196a7edfc041c9d327d14f1 (patch)
tree324fee8613eaa31f2da2c0aecb03375a91e3fb34
parent4590a544b33b787daf0ccd6bf6b62f3b97c68781 (diff)
[PATCH] neofb: Fix pseudo_palette array overrun in neofb_setcolreg
The pseudo_palette has room for 16 entries only, but in truecolor mode, it attempts to write 256. Signed-off-by: Antonino Daplas <adaplas@gmail.com> Acked-by: Tero Roponen <teanropo@jyu.fi> Signed-off-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/video/neofb.c30
1 files changed, 16 insertions, 14 deletions
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index 395ccedde9a..fec4d255398 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -1285,34 +1285,36 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
if (regno >= fb->cmap.len || regno > 255)
return -EINVAL;
- switch (fb->var.bits_per_pixel) {
- case 8:
+ if (fb->var.bits_per_pixel <= 8) {
outb(regno, 0x3c8);
outb(red >> 10, 0x3c9);
outb(green >> 10, 0x3c9);
outb(blue >> 10, 0x3c9);
- break;
- case 16:
- ((u32 *) fb->pseudo_palette)[regno] =
+ } else if (regno < 16) {
+ switch (fb->var.bits_per_pixel) {
+ case 16:
+ ((u32 *) fb->pseudo_palette)[regno] =
((red & 0xf800)) | ((green & 0xfc00) >> 5) |
((blue & 0xf800) >> 11);
- break;
- case 24:
- ((u32 *) fb->pseudo_palette)[regno] =
+ break;
+ case 24:
+ ((u32 *) fb->pseudo_palette)[regno] =
((red & 0xff00) << 8) | ((green & 0xff00)) |
((blue & 0xff00) >> 8);
- break;
+ break;
#ifdef NO_32BIT_SUPPORT_YET
- case 32:
- ((u32 *) fb->pseudo_palette)[regno] =
+ case 32:
+ ((u32 *) fb->pseudo_palette)[regno] =
((transp & 0xff00) << 16) | ((red & 0xff00) << 8) |
((green & 0xff00)) | ((blue & 0xff00) >> 8);
- break;
+ break;
#endif
- default:
- return 1;
+ default:
+ return 1;
+ }
}
+
return 0;
}