macfb: Fix pseudo_palette size and overrun
PATCH 8/24 macfb: Fix pseudo_palette size and overrun
- the pseudo_palette is only 16 elements long.
- do not write to the pseudo_palette if regno (array index) is more than 15.
Signed-off-by Antonino Daplas <[email protected]>
---
drivers/video/macfb.c | 93 ++++++++++++++++++++++++++----------------------- 1 files changed, 50 insertions(+), 43 deletions(-)
drivers/video/macfb.c +50 -43
@@ -170,7 +170,7 @@ static struct fb_fix_screeninfo macfb_fi };static struct fb_info fb_info; -static u32 pseudo_palette[17 ]; +static u32 pseudo_palette[16 ];static int inverse =0 ;static int vidtest =0 ;
@@ -529,56 +529,63 @@ static int macfb_setcolreg(unsigned regnif (regno >= fb_info->cmap.len)return 1 ; -switch (fb_info->var.bits_per_pixel) { -case 1 : -/* We shouldn't get here */ -break ; -case 2 : -case 4 : -case 8 : -if (macfb_setpalette) -macfb_setpalette (regno, red, green, blue, fb_info); -else -return 1 ; -break ; -case 16 : -if (fb_info->var.red.offset ==10 ) { -/* 1:5:5:5 */ - ((u32 *) (fb_info->pseudo_palette))[regno] = +if (fb_info->var.bits_per_pixel <=8 ) { +switch (fb_info->var.bits_per_pixel) { +case 1 : +/* We shouldn't get here */ +break ; +case 2 : +case 4 : +case 8 : +if (macfb_setpalette) +macfb_setpalette (regno, red, green, blue, + fb_info); +else +return 1 ; +break ; + } + }else if (regno <16 ) { +switch (fb_info->var.bits_per_pixel) { +case 16 : +if (fb_info->var.red.offset ==10 ) { +/* 1:5:5:5 */ + ((u32 *) (fb_info->pseudo_palette))[regno] = ((red &0xf800 ) >>1 ) | ((green &0xf800 ) >>6 ) | ((blue &0xf800 ) >>11 ) | ((transp !=0 ) <<15 ); - }else { -/* 0:5:6:5 */ - ((u32 *) (fb_info->pseudo_palette))[regno] = + }else { +/* 0:5:6:5 */ + ((u32 *) (fb_info->pseudo_palette))[regno] = ((red &0xf800 ) ) | ((green &0xfc00 ) >>5 ) | ((blue &0xf800 ) >>11 ); + } +break ; +/* I'm pretty sure that one or the other of these +doesn't exist on 68k Macs */ +case 24 : + red >>=8 ; + green >>=8 ; + blue >>=8 ; + ((u32 *)(fb_info->pseudo_palette))[regno] = + (red << fb_info->var.red.offset) | + (green << fb_info->var.green.offset) | + (blue << fb_info->var.blue.offset); +break ; +case 32 : + red >>=8 ; + green >>=8 ; + blue >>=8 ; + ((u32 *)(fb_info->pseudo_palette))[regno] = + (red << fb_info->var.red.offset) | + (green << fb_info->var.green.offset) | + (blue << fb_info->var.blue.offset); +break ; } -break ; -/* I'm pretty sure that one or the other of these -doesn't exist on 68k Macs */ -case 24 : - red >>=8 ; - green >>=8 ; - blue >>=8 ; - ((u32 *)(fb_info->pseudo_palette))[regno] = - (red << fb_info->var.red.offset) | - (green << fb_info->var.green.offset) | - (blue << fb_info->var.blue.offset); -break ; -case 32 : - red >>=8 ; - green >>=8 ; - blue >>=8 ; - ((u32 *)(fb_info->pseudo_palette))[regno] = - (red << fb_info->var.red.offset) | - (green << fb_info->var.green.offset) | - (blue << fb_info->var.blue.offset); -break ; - } -return 0 ; + } + +return 0 ; }static struct fb_ops macfb_ops = {
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/