lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[PATCH] intelfb: Fix buffer overrun

Browse Source 
The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will
attempt to write more.

Coverity Bug 558

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Antonino A. Daplas
2006-03-11 03:27:26 -08:00
committed by Linus Torvalds
parent 8d57f2210e
commit d301524772
1 changed files with 27 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
drivers/video/intelfb/intelfbdrv.c
View File

@@ -1333,33 +1333,35 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
if (regno > 255) if (regno > 255)
return 1; return 1;
switch (dinfo->depth) { if (dinfo->depth == 8) {
case 8: red >>= 8;
{ green >>= 8;
red >>= 8; blue >>= 8;
green >>= 8;
blue >>= 8;
intelfbhw_setcolreg(dinfo, regno, red, green, blue, intelfbhw_setcolreg(dinfo, regno, red, green, blue,
transp); transp);
}
break;
case 15:
dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) |
((green & 0xf800) >> 6) |
((blue & 0xf800) >> 11);
break;
case 16:
dinfo->pseudo_palette[regno] = (red & 0xf800) |
((green & 0xfc00) >> 5) |
((blue & 0xf800) >> 11);
break;
case 24:
dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
(green & 0xff00) |
((blue & 0xff00) >> 8);
break;
} }
if (regno < 16) {
switch (dinfo->depth) {
case 15:
dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) |
((green & 0xf800) >> 6) |
((blue & 0xf800) >> 11);
break;
case 16:
dinfo->pseudo_palette[regno] = (red & 0xf800) |
((green & 0xfc00) >> 5) |
((blue & 0xf800) >> 11);
break;
case 24:
dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
(green & 0xff00) |
((blue & 0xff00) >> 8);
break;
}
}
return 0; return 0;
} }