Skip to contentSkip to conversation

cyblafb: Fix pseudo_palette array overrun in setcolreg

PATCH In review Antonino A. Daplas 1 participant 1 message Jun 2, 2007 Framebuffer layer

lore
Share & tools
lore

Antonino A. Daplas

author
#0 lore raw

PATCH 3/24 cyblafb: Fix pseudo_palette array overrun in setcolreg

The pseudo_palette has only 16 elements. Do not write if regno (the array index) is more than 15.

Signed-off-by Antonino Daplas <[email protected]>

---

 drivers/video/cyblafb.c |   21 ++++++++++++---------
 1 files changed, 12 insertions(+), 9 deletions(-)
drivers/video/cyblafb.c +12 -9
index 94a66c2..e23324d 100644
@@ -1068,15 +1068,18 @@ static int cyblafb_setcolreg(unsigned re
 		out8(0x3C9, green >> 10);
 		out8(0x3C9, blue >> 10);
 
-	} else if (bpp == 16)	// RGB 565
-		((u32 *) info->pseudo_palette)[regno] =
-		    (red & 0xF800) |
-		    ((green & 0xFC00) >> 5) | ((blue & 0xF800) >> 11);
-	else if (bpp == 32)	// ARGB 8888
-		((u32 *) info->pseudo_palette)[regno] =
-		    ((transp & 0xFF00) << 16) |
-		    ((red & 0xFF00) << 8) |
-		    ((green & 0xFF00)) | ((blue & 0xFF00) >> 8);
+	} else if (regno < 16) {
+		if (bpp == 16)	// RGB 565
+			((u32 *) info->pseudo_palette)[regno] =
+				(red & 0xF800) |
+				((green & 0xFC00) >> 5) |
+				((blue & 0xF800) >> 11);
+		else if (bpp == 32)	// ARGB 8888
+			((u32 *) info->pseudo_palette)[regno] =
+				((transp & 0xFF00) << 16) |
+				((red & 0xFF00) << 8) |
+				((green & 0xFF00)) | ((blue & 0xFF00) >> 8);
+	}
 
 	return 0;
 }

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/