Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eba50850 authored by Antonino A. Daplas's avatar Antonino A. Daplas Committed by Linus Torvalds
Browse files

[PATCH] vesafb: Fix color palette handling 



Fix out-of-bounds bug.  The pseudopalette has room only for 16 entries, thus,
write only the first 16 entries to the pseudopalette.

Signed-off-by: default avatarAntonino Daplas <adaplas@pol.net>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent b4d8aea6

drivers/video/vesafb.c

+25 −31
Original line number Diff line number Diff line
@@ -166,10 +166,10 @@ static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green, 
	if (regno >= info->cmap.len)

		return 1;



	switch (info->var.bits_per_pixel) {

	case 8:

	if (info->var.bits_per_pixel == 8)

		vesa_setpalette(regno,red,green,blue);

		break;

	else if (regno < 16) {

		switch (info->var.bits_per_pixel) {

		case 16:

			if (info->var.red.offset == 10) {

				/* 1:5:5:5 */
@@ -186,14 +186,6 @@ static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green, 
			}

			break;

		case 24:

		red   >>= 8;

		green >>= 8;

		blue  >>= 8;

		((u32 *)(info->pseudo_palette))[regno] =

			(red   << info->var.red.offset)   |

			(green << info->var.green.offset) |

			(blue  << info->var.blue.offset);

		break;

		case 32:

			red   >>= 8;

			green >>= 8;
@@ -204,6 +196,8 @@ static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green, 
				(blue  << info->var.blue.offset);

			break;

		}

	}



	return 0;

}