Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=24fc72239ab5a2d26ebdd4f6950539e6120d1a54
Commit:     24fc72239ab5a2d26ebdd4f6950539e6120d1a54
Parent:     9058be43cf9f32b6c636aa6954b4f1a6b22098f6
Author:     Antonino A. Daplas <[EMAIL PROTECTED]>
AuthorDate: Tue Jul 17 04:05:37 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Tue Jul 17 10:23:12 2007 -0700

    macfb: fix pseudo_palette size and overrun
    
    - the pseudo_palette is only 16 elements long.
    - do not write to the pseudo_palette if regno (array index) is more than 15.
    
    Signed-off-by: Antonino Daplas <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
 drivers/video/macfb.c |   93 ++++++++++++++++++++++++++----------------------
 1 files changed, 50 insertions(+), 43 deletions(-)

diff --git a/drivers/video/macfb.c b/drivers/video/macfb.c
index f7d647d..aa8c714 100644
--- a/drivers/video/macfb.c
+++ b/drivers/video/macfb.c
@@ -170,7 +170,7 @@ static struct fb_fix_screeninfo macfb_fix = {
 };
 
 static struct fb_info fb_info;
-static u32 pseudo_palette[17];
+static u32 pseudo_palette[16];
 static int inverse   = 0;
 static int vidtest   = 0;
 
@@ -529,56 +529,63 @@ static int macfb_setcolreg(unsigned regno, unsigned red, 
unsigned green,
        if (regno >= fb_info->cmap.len)
                return 1;
 
-       switch (fb_info->var.bits_per_pixel) {
-       case 1:
-               /* We shouldn't get here */
-               break;
-       case 2:
-       case 4:
-       case 8:
-               if (macfb_setpalette)
-                       macfb_setpalette(regno, red, green, blue, fb_info);
-               else
-                       return 1;
-               break;
-       case 16:
-               if (fb_info->var.red.offset == 10) {
-                       /* 1:5:5:5 */
-                       ((u32*) (fb_info->pseudo_palette))[regno] =
+       if (fb_info->var.bits_per_pixel <= 8) {
+               switch (fb_info->var.bits_per_pixel) {
+               case 1:
+                       /* We shouldn't get here */
+                       break;
+               case 2:
+               case 4:
+               case 8:
+                       if (macfb_setpalette)
+                               macfb_setpalette(regno, red, green, blue,
+                                                fb_info);
+                       else
+                               return 1;
+                       break;
+               }
+       } else if (regno < 16) {
+               switch (fb_info->var.bits_per_pixel) {
+               case 16:
+                       if (fb_info->var.red.offset == 10) {
+                               /* 1:5:5:5 */
+                               ((u32*) (fb_info->pseudo_palette))[regno] =
                                        ((red   & 0xf800) >>  1) |
                                        ((green & 0xf800) >>  6) |
                                        ((blue  & 0xf800) >> 11) |
                                        ((transp != 0) << 15);
-               } else {
-                       /* 0:5:6:5 */
-                       ((u32*) (fb_info->pseudo_palette))[regno] =
+                       } else {
+                               /* 0:5:6:5 */
+                               ((u32*) (fb_info->pseudo_palette))[regno] =
                                        ((red   & 0xf800)      ) |
                                        ((green & 0xfc00) >>  5) |
                                        ((blue  & 0xf800) >> 11);
+                       }
+                       break;
+                       /* I'm pretty sure that one or the other of these
+                          doesn't exist on 68k Macs */
+               case 24:
+                       red   >>= 8;
+                       green >>= 8;
+                       blue  >>= 8;
+                       ((u32 *)(fb_info->pseudo_palette))[regno] =
+                               (red   << fb_info->var.red.offset)   |
+                               (green << fb_info->var.green.offset) |
+                               (blue  << fb_info->var.blue.offset);
+                       break;
+               case 32:
+                       red   >>= 8;
+                       green >>= 8;
+                       blue  >>= 8;
+                       ((u32 *)(fb_info->pseudo_palette))[regno] =
+                               (red   << fb_info->var.red.offset)   |
+                               (green << fb_info->var.green.offset) |
+                               (blue  << fb_info->var.blue.offset);
+                       break;
                }
-               break;  
-               /* I'm pretty sure that one or the other of these
-                  doesn't exist on 68k Macs */
-       case 24:
-               red   >>= 8;
-               green >>= 8;
-               blue  >>= 8;
-               ((u32 *)(fb_info->pseudo_palette))[regno] =
-                       (red   << fb_info->var.red.offset)   |
-                       (green << fb_info->var.green.offset) |
-                       (blue  << fb_info->var.blue.offset);
-               break;
-       case 32:
-               red   >>= 8;
-               green >>= 8;
-               blue  >>= 8;
-               ((u32 *)(fb_info->pseudo_palette))[regno] =
-                       (red   << fb_info->var.red.offset)   |
-                       (green << fb_info->var.green.offset) |
-                       (blue  << fb_info->var.blue.offset);
-               break;
-    }
-    return 0;
+       }
+
+       return 0;
 }
 
 static struct fb_ops macfb_ops = {
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to