Commit ed621785 authored Mar 11, 2006 by Antonino A. Daplas Committed by Linus Torvalds Mar 11, 2006

[PATCH] radeonfb: Fix static array overrun



radeonfb_parse_monitor_layout() will produce an array overrun if passed with a
substring of length higher than 4 (ie, "XXXXX,YYYYYY").

Coverity Bug 494

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

parent 8e650987

drivers/video/aty/radeon_monitor.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -396,6 +396,10 @@ static int __devinit radeon_parse_monitor_layout(struct radeonfb_info *rinfo,
		s1[i] = *s;
		i++;
		}

		if (i > 4)
		i = 4;

		} while (*s++);
		if (second)
		s2[i] = 0;