Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 973d9ab2 authored by Antonino A. Daplas's avatar Antonino A. Daplas Committed by Linus Torvalds
Browse files

tridentfb: fix pseudo_palette array overrun in setcolreg 



The pseudo_palette has only 16 elements. Do not write if regno (the array
index) is more than 15.

Signed-off-by: default avatarAntonino Daplas <adaplas@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent eb3daa83

drivers/video/tridentfb.c

+16 −14
Original line number Diff line number Diff line
@@ -984,7 +984,8 @@ static int tridentfb_setcolreg(unsigned regno, unsigned red, unsigned green, 
		t_outb(green>>10,0x3C9);

		t_outb(blue>>10,0x3C9);



	} else if (bpp == 16) {	/* RGB 565 */

	} else if (regno < 16) {

		if (bpp == 16) {	/* RGB 565 */

			u32 col;



			col = (red & 0xF800) | ((green & 0xFC00) >> 5) |
@@ -997,6 +998,7 @@ static int tridentfb_setcolreg(unsigned regno, unsigned red, unsigned green, 
				((red & 0xFF00) << 8) 		|

				((green & 0xFF00))		|

				((blue & 0xFF00)>>8);

	}



//	debug("exit\n");

	return 0;