Commit df31ef4d authored Feb 17, 2010 by Marcin Slusarz Committed by Ben Skeggs Feb 25, 2010

drm/nouveau: fix pramdac_table range checking



get_tmds_index_reg reads some value from stack when mlv happens
to be equal to size of pramdac_table array. Fix it.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

parent a1606a95

drivers/gpu/drm/nouveau/nouveau_bios.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv)
		dacoffset ^= 8;
		return 0x6808b0 + dacoffset;
		} else {
		if (mlv > ARRAY_SIZE(pramdac_table)) {
		if (mlv >= ARRAY_SIZE(pramdac_table)) {
		NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n",
		mlv);
		return 0;