pvr2fb: Fix pseudo_palette array overrun and typecast
PATCH 11/24 pvr2fb: Fix pseudo_palette array overrun and typecast
- the pseudo_palette has only 16 elements. Do not write if regno (the array index) is more than 15.
- if using generic drawing libraries, the typecast of pseudo_palette is always u32 *
---
drivers/video/pvr2fb.c | 7 ++++--- 1 files changed, 4 insertions(+), 3 deletions(-)
drivers/video/pvr2fb.c +4 -3
@@ -337,24 +337,25 @@ static int pvr2fb_setcolreg(unsigned int ((blue &0xf800 ) >>11 );pvr2fb_set_pal_entry (par, regno, tmp); - ((u16 *)(info->pseudo_palette))[regno] = tmp;break ;case 24 :/* RGB 888 */ red >>=8 ; green >>=8 ; blue >>=8 ; - ((u32 *)(info->pseudo_palette))[regno] = (red <<16 ) | (green <<8 ) | blue; + tmp = (red <<16 ) | (green <<8 ) | blue;break ;case 32 :/* ARGB 8888 */ red >>=8 ; green >>=8 ; blue >>=8 ; tmp = (transp <<24 ) | (red <<16 ) | (green <<8 ) | blue;pvr2fb_set_pal_entry (par, regno, tmp); - ((u32 *)(info->pseudo_palette))[regno] = tmp;break ;default :pr_debug ("Invalid bit depth %d?!?\n" , info->var.bits_per_pixel);return 1 ; } +if (regno <16 ) + ((u32 *)(info->pseudo_palette))[regno] = tmp; +return 0 ; }
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
Quoted 6 lines · Antonino A. Daplas
- the
pseudo_palettehas only 16 elements. Do not write if regno (the array index) is more than 15.
- if using generic drawing libraries, the typecast ofpseudo_paletteis always u32 *Signed-off-by Antonino Daplas <[email protected]>
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/