sisfb: Read buffer overflow

PATCH New Roel Kluin 1 participant 1 message Jul 23, 2009 Framebuffer layer

lore

Share & tools

lore

Roel Kluin

author

2009-07-23 17:48 UTC #0 lore raw

PATCH 1/1 sisfb: Read buffer overflow

If called with mode_idx = 1, rate = 68, a read occurs from sisfb_vrate[-1].refresh.

Signed-off-by Roel Kluin <[email protected]>

---
This presumes the conditional should be reversed, correct?

drivers/video/sis/sis_main.c +2 -2

index 636a785..35531d7 100644
@@ -698,8 +698,8 @@ sisfb_search_refresh_rate(struct sis_video_info *ivideo, unsigned int rate, int
 						rate, sisfb_vrate[i].refresh);
 					ivideo->rate_idx = sisfb_vrate[i].idx;
 					ivideo->refresh_rate = sisfb_vrate[i].refresh;
-				} else if(((rate - sisfb_vrate[i-1].refresh) <= 2)
-						&& (sisfb_vrate[i].idx != 1)) {
+				} else if((sisfb_vrate[i].idx != 1) &&
+						((rate - sisfb_vrate[i-1].refresh) <= 2)) {
 					DPRINTK("sisfb: Adjusting rate from %d down to %d\n",
 						rate, sisfb_vrate[i-1].refresh);
 					ivideo->rate_idx = sisfb_vrate[i-1].idx;

------------------------------------------------------------------------------