[PATCH] vesafb: Fix color palette handling

Fix out-of-bounds bug.  The pseudopalette has room only for 16 entries, thus,
write only the first 16 entries to the pseudopalette.

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
index 4f02615225ac6c92ad9c77276cbb547aaf7f9f6f..67e2154439539f81ce9e53079acdd286ba3cbb51 100644 (file)
--- a/drivers/video/vesafb.c
+++ b/drivers/video/vesafb.c
@@ -166,45 +166,39 @@ static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green,
        if (regno >= info->cmap.len)
                return 1;
 
-       switch (info->var.bits_per_pixel) {
-       case 8:
+       if (info->var.bits_per_pixel == 8)
                vesa_setpalette(regno,red,green,blue);
-               break;
-       case 16:
-               if (info->var.red.offset == 10) {
-                       /* 1:5:5:5 */
-                       ((u32*) (info->pseudo_palette))[regno] =        
+       else if (regno < 16) {
+               switch (info->var.bits_per_pixel) {
+               case 16:
+                       if (info->var.red.offset == 10) {
+                               /* 1:5:5:5 */
+                               ((u32*) (info->pseudo_palette))[regno] =
                                        ((red   & 0xf800) >>  1) |
                                        ((green & 0xf800) >>  6) |
                                        ((blue  & 0xf800) >> 11);
-               } else {
-                       /* 0:5:6:5 */
-                       ((u32*) (info->pseudo_palette))[regno] =        
+                       } else {
+                               /* 0:5:6:5 */
+                               ((u32*) (info->pseudo_palette))[regno] =
                                        ((red   & 0xf800)      ) |
                                        ((green & 0xfc00) >>  5) |
                                        ((blue  & 0xf800) >> 11);
+                       }
+                       break;
+               case 24:
+               case 32:
+                       red   >>= 8;
+                       green >>= 8;
+                       blue  >>= 8;
+                       ((u32 *)(info->pseudo_palette))[regno] =
+                               (red   << info->var.red.offset)   |
+                               (green << info->var.green.offset) |
+                               (blue  << info->var.blue.offset);
+                       break;
                }
-               break;
-       case 24:
-               red   >>= 8;
-               green >>= 8;
-               blue  >>= 8;
-               ((u32 *)(info->pseudo_palette))[regno] =
-                       (red   << info->var.red.offset)   |
-                       (green << info->var.green.offset) |
-                       (blue  << info->var.blue.offset);
-               break;
-       case 32:
-               red   >>= 8;
-               green >>= 8;
-               blue  >>= 8;
-               ((u32 *)(info->pseudo_palette))[regno] =
-                       (red   << info->var.red.offset)   |
-                       (green << info->var.green.offset) |
-                       (blue  << info->var.blue.offset);
-               break;
-    }
-    return 0;
+       }
+
+       return 0;
 }
 
 static struct fb_ops vesafb_ops = {