summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorAntonino A. Daplas <adaplas@gmail.com>2006-03-11 03:27:26 -0800
committerLinus Torvalds <torvalds@g5.osdl.org>2006-03-11 09:19:35 -0800
commitd301524772be3eef5fae1bcd5ca76fac69bb3b6e (patch)
treed2d26317432a5726a7aa6192d510247990dfd7c5 /drivers
parent8d57f2210e72e0168734bd1503b9e52a71f53d65 (diff)
downloadlinux-d301524772be3eef5fae1bcd5ca76fac69bb3b6e.tar.bz2
[PATCH] intelfb: Fix buffer overrun
The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will attempt to write more. Coverity Bug 558 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/video/intelfb/intelfbdrv.c50
1 files changed, 26 insertions, 24 deletions
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 6b8bd3cdf9c0..995b47c165a7 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -1333,33 +1333,35 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
if (regno > 255)
return 1;
- switch (dinfo->depth) {
- case 8:
- {
- red >>= 8;
- green >>= 8;
- blue >>= 8;
+ if (dinfo->depth == 8) {
+ red >>= 8;
+ green >>= 8;
+ blue >>= 8;
+
+ intelfbhw_setcolreg(dinfo, regno, red, green, blue,
+ transp);
+ }
- intelfbhw_setcolreg(dinfo, regno, red, green, blue,
- transp);
+ if (regno < 16) {
+ switch (dinfo->depth) {
+ case 15:
+ dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) |
+ ((green & 0xf800) >> 6) |
+ ((blue & 0xf800) >> 11);
+ break;
+ case 16:
+ dinfo->pseudo_palette[regno] = (red & 0xf800) |
+ ((green & 0xfc00) >> 5) |
+ ((blue & 0xf800) >> 11);
+ break;
+ case 24:
+ dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
+ (green & 0xff00) |
+ ((blue & 0xff00) >> 8);
+ break;
}
- break;
- case 15:
- dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) |
- ((green & 0xf800) >> 6) |
- ((blue & 0xf800) >> 11);
- break;
- case 16:
- dinfo->pseudo_palette[regno] = (red & 0xf800) |
- ((green & 0xfc00) >> 5) |
- ((blue & 0xf800) >> 11);
- break;
- case 24:
- dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
- (green & 0xff00) |
- ((blue & 0xff00) >> 8);
- break;
}
+
return 0;
}