Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d3015247 authored by Antonino A. Daplas's avatar Antonino A. Daplas Committed by Linus Torvalds
Browse files

[PATCH] intelfb: Fix buffer overrun 



The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will
attempt to write more.

Coverity Bug 558

Signed-off-by: default avatarAntonino Daplas <adaplas@pol.net>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 8d57f221

drivers/video/intelfb/intelfbdrv.c

+26 −24
Original line number Diff line number Diff line
@@ -1333,9 +1333,7 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green, 
	if (regno > 255)

		return 1;



	switch (dinfo->depth) {

	case 8:

		{

	if (dinfo->depth == 8) {

		red >>= 8;

		green >>= 8;

		blue >>= 8;
@@ -1343,7 +1341,9 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green, 
		intelfbhw_setcolreg(dinfo, regno, red, green, blue,

				    transp);

	}

		break;



	if (regno < 16) {

		switch (dinfo->depth) {

		case 15:

			dinfo->pseudo_palette[regno] = ((red & 0xf800) >>  1) |

				((green & 0xf800) >>  6) |
@@ -1360,6 +1360,8 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green, 
				((blue  & 0xff00) >> 8);

			break;

		}

	}



	return 0;

}