Emulation/switch-linux
1
0
Fork 0
mirror of https://github.com/fail0verflow/switch-linux.git synced 2025-05-04 02:34:21 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[PATCH] intelfb: Fix buffer overrun

Browse source 
The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will
attempt to write more.

Coverity Bug 558

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Antonino A. Daplas 2006-03-11 03:27:26 -08:00 • committed by Linus Torvalds
parent 8d57f2210e
commit d301524772
1 changed files with 27 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/video/intelfb/intelfbdrv.c
View file

@ -1333,9 +1333,7 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
if (regno > 255) if (regno > 255)
return 1; return 1;
switch (dinfo->depth) { if (dinfo->depth == 8) {
case 8:
{
red >>= 8; red >>= 8;
green >>= 8; green >>= 8;
blue >>= 8; blue >>= 8;
@ -1343,7 +1341,9 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
intelfbhw_setcolreg(dinfo, regno, red, green, blue, intelfbhw_setcolreg(dinfo, regno, red, green, blue,
transp); transp);
} }
break;
if (regno < 16) {
switch (dinfo->depth) {
case 15: case 15:
dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) | dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) |
((green & 0xf800) >> 6) | ((green & 0xf800) >> 6) |
@ -1360,6 +1360,8 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
((blue & 0xff00) >> 8); ((blue & 0xff00) >> 8);
break; break;
} }
}
return 0; return 0;
} }