Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a2b7d2e9 authored by Antonino A. Daplas's avatar Antonino A. Daplas Committed by Linus Torvalds
Browse files

neofb: Fix pseudo_palette array overrun in neofb_setcolreg



The pseudo_palette has room for 16 entries only, but in truecolor mode, it
attempts to write 256.

Signed-off-by: default avatarAntonino Daplas <adaplas@gmail.com>
Acked-by: default avatarTero Roponen <teanropo@jyu.fi>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 3f0a6766
Loading
Loading
Loading
Loading
+16 −14
Original line number Original line Diff line number Diff line
@@ -1286,14 +1286,14 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
	if (regno >= fb->cmap.len || regno > 255)
	if (regno >= fb->cmap.len || regno > 255)
		return -EINVAL;
		return -EINVAL;


	switch (fb->var.bits_per_pixel) {
	if (fb->var.bits_per_pixel <= 8) {
	case 8:
		outb(regno, 0x3c8);
		outb(regno, 0x3c8);


		outb(red >> 10, 0x3c9);
		outb(red >> 10, 0x3c9);
		outb(green >> 10, 0x3c9);
		outb(green >> 10, 0x3c9);
		outb(blue >> 10, 0x3c9);
		outb(blue >> 10, 0x3c9);
		break;
	} else if (regno < 16) {
		switch (fb->var.bits_per_pixel) {
		case 16:
		case 16:
			((u32 *) fb->pseudo_palette)[regno] =
			((u32 *) fb->pseudo_palette)[regno] =
				((red & 0xf800)) | ((green & 0xfc00) >> 5) |
				((red & 0xf800)) | ((green & 0xfc00) >> 5) |
@@ -1314,6 +1314,8 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
		default:
		default:
			return 1;
			return 1;
		}
		}
	}

	return 0;
	return 0;
}
}