intelfb: Fix buffer overrun
PATCH 13/18 intelfb: Fix buffer overrun
The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will attempt to write more.
Coverity Bug 558
Signed-off-by Antonino Daplas <[email protected]>
---
drivers/video/intelfb/intelfbdrv.c | 50 +++++++++++++++++++----------------- 1 files changed, 26 insertions(+), 24 deletions(-)
drivers/video/intelfb/intelfbdrv.c +26 -24
@@ -1333,33 +1333,35 @@ intelfb_setcolreg(unsigned regno, unsignif (regno >255 )return 1 ; -switch (dinfo->depth) { -case 8 : - { - red >>=8 ; - green >>=8 ; - blue >>=8 ; +if (dinfo->depth ==8 ) { + red >>=8 ; + green >>=8 ; + blue >>=8 ; -intelfbhw_setcolreg (dinfo, regno, red, green, blue, - transp); +intelfbhw_setcolreg (dinfo, regno, red, green, blue, + transp); + } + +if (regno <16 ) { +switch (dinfo->depth) { +case 15 : + dinfo->pseudo_palette[regno] = ((red &0xf800 ) >>1 ) | + ((green &0xf800 ) >>6 ) | + ((blue &0xf800 ) >>11 ); +break ; +case 16 : + dinfo->pseudo_palette[regno] = (red &0xf800 ) | + ((green &0xfc00 ) >>5 ) | + ((blue &0xf800 ) >>11 ); +break ; +case 24 : + dinfo->pseudo_palette[regno] = ((red &0xff00 ) <<8 ) | + (green &0xff00 ) | + ((blue &0xff00 ) >>8 ); +break ; } -break ; -case 15 : - dinfo->pseudo_palette[regno] = ((red &0xf800 ) >>1 ) | - ((green &0xf800 ) >>6 ) | - ((blue &0xf800 ) >>11 ); -break ; -case 16 : - dinfo->pseudo_palette[regno] = (red &0xf800 ) | - ((green &0xfc00 ) >>5 ) | - ((blue &0xf800 ) >>11 ); -break ; -case 24 : - dinfo->pseudo_palette[regno] = ((red &0xff00 ) <<8 ) | - (green &0xff00 ) | - ((blue &0xff00 ) >>8 ); -break ; } +return 0 ; }
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642