Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d63870db authored by Roel Kluin's avatar Roel Kluin Committed by Linus Torvalds
Browse files

sisfb: read buffer overflow 



If called with mode_idx = 1, rate = 68, a read occurs from
sisfb_vrate[-1].refresh.

Signed-off-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
Cc: Thomas Winischhofer <thomas@winischhofer.net>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 2f93e8f4

drivers/video/sis/sis_main.c

+2 −2
Original line number Diff line number Diff line
@@ -698,8 +698,8 @@ sisfb_search_refresh_rate(struct sis_video_info *ivideo, unsigned int rate, int 
						rate, sisfb_vrate[i].refresh);

					ivideo->rate_idx = sisfb_vrate[i].idx;

					ivideo->refresh_rate = sisfb_vrate[i].refresh;

				} else if(((rate - sisfb_vrate[i-1].refresh) <= 2)

						&& (sisfb_vrate[i].idx != 1)) {

				} else if((sisfb_vrate[i].idx != 1) &&

						((rate - sisfb_vrate[i-1].refresh) <= 2)) {

					DPRINTK("sisfb: Adjusting rate from %d down to %d\n",

						rate, sisfb_vrate[i-1].refresh);

					ivideo->rate_idx = sisfb_vrate[i-1].idx;