Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 24fc7223 authored by Antonino A. Daplas's avatar Antonino A. Daplas Committed by Linus Torvalds
Browse files

macfb: fix pseudo_palette size and overrun 



- the pseudo_palette is only 16 elements long.
- do not write to the pseudo_palette if regno (array index) is more than 15.

Signed-off-by: default avatarAntonino Daplas <adaplas@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 9058be43

drivers/video/macfb.c

+50 −43
Original line number Diff line number Diff line
@@ -170,7 +170,7 @@ static struct fb_fix_screeninfo macfb_fix = { 
};



static struct fb_info fb_info;

static u32 pseudo_palette[17];

static u32 pseudo_palette[16];

static int inverse   = 0;

static int vidtest   = 0;
@@ -529,6 +529,7 @@ static int macfb_setcolreg(unsigned regno, unsigned red, unsigned green, 
	if (regno >= fb_info->cmap.len)

		return 1;



	if (fb_info->var.bits_per_pixel <= 8) {

		switch (fb_info->var.bits_per_pixel) {

		case 1:

			/* We shouldn't get here */
@@ -537,10 +538,14 @@ static int macfb_setcolreg(unsigned regno, unsigned red, unsigned green, 
		case 4:

		case 8:

			if (macfb_setpalette)

			macfb_setpalette(regno, red, green, blue, fb_info);

				macfb_setpalette(regno, red, green, blue,

						 fb_info);

			else

				return 1;

			break;

		}

	} else if (regno < 16) {

		switch (fb_info->var.bits_per_pixel) {

		case 16:

			if (fb_info->var.red.offset == 10) {

				/* 1:5:5:5 */
@@ -578,6 +583,8 @@ static int macfb_setcolreg(unsigned regno, unsigned red, unsigned green, 
				(blue  << fb_info->var.blue.offset);

			break;

		}

	}



	return 0;

}