Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 75921810 authored by Antonino A. Daplas's avatar Antonino A. Daplas Committed by Linus Torvalds
Browse files

cyblafb: fix pseudo_palette array overrun in setcolreg 



The pseudo_palette has only 16 elements. Do not write if regno (the array
index) is more than 15.

Signed-off-by: default avatarAntonino Daplas <adaplas@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 11494543

drivers/video/cyblafb.c

+12 −9
Original line number Diff line number Diff line
@@ -1068,15 +1068,18 @@ static int cyblafb_setcolreg(unsigned regno, unsigned red, unsigned green, 
		out8(0x3C9, green >> 10);

		out8(0x3C9, blue >> 10);



	} else if (bpp == 16)	// RGB 565

	} else if (regno < 16) {

		if (bpp == 16)	// RGB 565

			((u32 *) info->pseudo_palette)[regno] =

				(red & 0xF800) |

		    ((green & 0xFC00) >> 5) | ((blue & 0xF800) >> 11);

				((green & 0xFC00) >> 5) |

				((blue & 0xF800) >> 11);

		else if (bpp == 32)	// ARGB 8888

			((u32 *) info->pseudo_palette)[regno] =

				((transp & 0xFF00) << 16) |

				((red & 0xFF00) << 8) |

				((green & 0xFF00)) | ((blue & 0xFF00) >> 8);

	}



	return 0;

}