Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a2b7d2e9 authored by Antonino A. Daplas's avatar Antonino A. Daplas Committed by Linus Torvalds
Browse files

neofb: Fix pseudo_palette array overrun in neofb_setcolreg 



The pseudo_palette has room for 16 entries only, but in truecolor mode, it
attempts to write 256.

Signed-off-by: default avatarAntonino Daplas <adaplas@gmail.com>
Acked-by: default avatarTero Roponen <teanropo@jyu.fi>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 3f0a6766

drivers/video/neofb.c

+16 −14
Original line number Original line Diff line number Diff line
@@ -1286,14 +1286,14 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue, 
	if (regno >= fb->cmap.len || regno > 255)

	if (regno >= fb->cmap.len || regno > 255)

		return -EINVAL;

		return -EINVAL;





	switch (fb->var.bits_per_pixel) {

	if (fb->var.bits_per_pixel <= 8) {

	case 8:

		outb(regno, 0x3c8);

		outb(regno, 0x3c8);





		outb(red >> 10, 0x3c9);

		outb(red >> 10, 0x3c9);

		outb(green >> 10, 0x3c9);

		outb(green >> 10, 0x3c9);

		outb(blue >> 10, 0x3c9);

		outb(blue >> 10, 0x3c9);

		break;

	} else if (regno < 16) {

		switch (fb->var.bits_per_pixel) {

		case 16:

		case 16:

			((u32 *) fb->pseudo_palette)[regno] =

			((u32 *) fb->pseudo_palette)[regno] =

				((red & 0xf800)) | ((green & 0xfc00) >> 5) |

				((red & 0xf800)) | ((green & 0xfc00) >> 5) |
@@ -1314,6 +1314,8 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue, 
		default:

		default:

			return 1;

			return 1;

		}

		}

	}



	return 0;

	return 0;

}

}