tdfxfb: Fix buffer overrun
PATCH 14/18 tdfxfb: Fix buffer overrun
The pseudo_palette has room only for 16 entries, but tdfxfb_setcolreg may attempt to write more.
Coverity Bug 557
Signed-off-by Antonino Daplas <[email protected]>
---
drivers/video/tdfxfb.c | 42 +++++++++++++++++++++++------------------- 1 files changed, 23 insertions(+), 19 deletions(-)
drivers/video/tdfxfb.c +23 -19
@@ -786,28 +786,32 @@ static int tdfxfb_setcolreg(unsigned regif (regno >= info->cmap.len || regno >255 )return 1 ;switch (info->fix.visual) { -case FB_VISUAL_PSEUDOCOLOR : - rgbcol =(((u32 )red &0xff00 ) <<8 ) | - (((u32 )green &0xff00 ) <<0 ) | - (((u32 )blue &0xff00 ) >>8 ); -do_setpalentry (par, regno, rgbcol); -break ; -/* Truecolor has no hardware color palettes. */ -case FB_VISUAL_TRUECOLOR : +case FB_VISUAL_PSEUDOCOLOR : + rgbcol =(((u32 )red &0xff00 ) <<8 ) | + (((u32 )green &0xff00 ) <<0 ) | + (((u32 )blue &0xff00 ) >>8 ); +do_setpalentry (par, regno, rgbcol); +break ; +/* Truecolor has no hardware color palettes. */ +case FB_VISUAL_TRUECOLOR : +if (regno <16 ) { rgbcol = (CNVT_TOHW ( red, info->var.red.length) << info->var.red.offset) | - (CNVT_TOHW ( green, info->var.green.length) << - info->var.green.offset) | - (CNVT_TOHW ( blue, info->var.blue.length) << - info->var.blue.offset) | - (CNVT_TOHW ( transp, info->var.transp.length) << - info->var.transp.offset); - par->palette[regno] = rgbcol; -break ; -default : -DPRINTK ("bad depth %u\n" , info->var.bits_per_pixel); -break ; + (CNVT_TOHW ( green, info->var.green.length) << + info->var.green.offset) | + (CNVT_TOHW ( blue, info->var.blue.length) << + info->var.blue.offset) | + (CNVT_TOHW ( transp, info->var.transp.length) << + info->var.transp.offset); + par->palette[regno] = rgbcol; + } + +break ; +default : +DPRINTK ("bad depth %u\n" , info->var.bits_per_pixel); +break ; } +return 0 ; }
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642