Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=000d5335c6e7f5dbcd849b62b4be7ae005aa6974
Commit:     000d5335c6e7f5dbcd849b62b4be7ae005aa6974
Parent:     c312f97df65bf38a8e7f664b76154639f593775d
Author:     Antonino A. Daplas <[EMAIL PROTECTED]>
AuthorDate: Tue Jul 17 04:05:44 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Tue Jul 17 10:23:13 2007 -0700

    sisfb: fix pseudo_palette array size and overrun
    
    - the pseudo_palette is only 16 elements long.
    - do not write to the pseudo_palette if regno (array index) is more than 15.
    
    Signed-off-by: Antonino Daplas <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
---
 drivers/video/sis/sis.h      |    2 +-
 drivers/video/sis/sis_main.c |    6 ++++++
 2 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/drivers/video/sis/sis.h b/drivers/video/sis/sis.h
index d5e2d9c..d53bf69 100644
--- a/drivers/video/sis/sis.h
+++ b/drivers/video/sis/sis.h
@@ -479,7 +479,7 @@ struct sis_video_info {
        struct fb_var_screeninfo default_var;
 
        struct fb_fix_screeninfo sisfb_fix;
-       u32             pseudo_palette[17];
+       u32             pseudo_palette[16];
 
        struct sisfb_monitor {
                u16 hmin;
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index 93d07ef..e8ccace 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -1405,12 +1405,18 @@ sisfb_setcolreg(unsigned regno, unsigned red, unsigned 
green, unsigned blue,
                }
                break;
        case 16:
+               if (regno >= 16)
+                       break;
+
                ((u32 *)(info->pseudo_palette))[regno] =
                                (red & 0xf800)          |
                                ((green & 0xfc00) >> 5) |
                                ((blue & 0xf800) >> 11);
                break;
        case 32:
+               if (regno >= 16)
+                       break;
+
                red >>= 8;
                green >>= 8;
                blue >>= 8;
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to