From fc9a89f97e532152ae614d5ce717b81c8f8b0e91 Mon Sep 17 00:00:00 2001
From: Darren Jenkins <darrenrjenkins@gmail.com>
Date: Thu, 7 Jan 2010 01:35:21 -0500
Subject: drm/radeon: fix a couple of array index errors
There are a couple of array overruns, and some associated confusion in
the code.
This is just a wild guess at what the code should actually look like.
Coverity CID: 13305 13306
agd5f: fix up the original intent of the timing code
Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com>
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
drivers/gpu/drm/radeon/radeon_legacy_tv.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_tv.c b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
index 3a12bb0c056..417684daef4 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_tv.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
@@ -77,7 +77,7 @@ struct radeon_tv_mode_constants {
unsigned pix_to_tv;
};
-static const uint16_t hor_timing_NTSC[] = {
+static const uint16_t hor_timing_NTSC[MAX_H_CODE_TIMING_LEN] = {
0x0007,
0x003f,
0x0263,
@@ -98,7 +98,7 @@ static const uint16_t hor_timing_NTSC[] = {
0
};
-static const uint16_t vert_timing_NTSC[] = {
+static const uint16_t vert_timing_NTSC[MAX_V_CODE_TIMING_LEN] = {
0x2001,
0x200d,
0x1006,
@@ -115,7 +115,7 @@ static const uint16_t vert_timing_NTSC[] = {
0
};
-static const uint16_t hor_timing_PAL[] = {
+static const uint16_t hor_timing_PAL[MAX_H_CODE_TIMING_LEN] = {
0x0007,
0x0058,
0x027c,
@@ -136,7 +136,7 @@ static const uint16_t hor_timing_PAL[] = {
0
};
-static const uint16_t vert_timing_PAL[] = {
+static const uint16_t vert_timing_PAL[MAX_V_CODE_TIMING_LEN] = {
0x2001,
0x200c,
0x1005,
@@ -623,9 +623,9 @@ void radeon_legacy_tv_mode_set(struct drm_encoder *encoder,
}
flicker_removal = (tmp + 500) / 1000;
- if (flicker_removal < 3)
- flicker_removal = 3;
- for (i = 0; i < 6; ++i) {
+ if (flicker_removal < 2)
+ flicker_removal = 2;
+ for (i = 0; i < ARRAY_SIZE(SLOPE_limit); ++i) {
if (flicker_removal == SLOPE_limit[i])
break;
}
--
cgit v1.2.3-18-g5258