[PATCH] Fix pseudo_palette setup in asiliantfb_setcolreg()

The setcolreg function will attempt to write 24 color entries to the
pseudo_pallette.  However, the pseudo_palette has only space for 16 entries.

Thanks to Atsushi Nemoto for reporting this bug.

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/video/asiliantfb.c b/drivers/video/asiliantfb.c
index 69f75547865df1c799cf427d796672aa73c3ab48..c924d81f7978f2b01ee391afa38e3461357ab0b1 100644 (file)
--- a/drivers/video/asiliantfb.c
+++ b/drivers/video/asiliantfb.c
@@ -322,32 +322,29 @@ static int asiliantfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
        writeb(green, mmio_base + 0x791);
        writeb(blue, mmio_base + 0x791);
 
-       switch(p->var.bits_per_pixel) {
-       case 15:
-               if (regno < 16) {
+       if (regno < 16) {
+               switch(p->var.red.offset) {
+               case 10: /* RGB 555 */
                        ((u32 *)(p->pseudo_palette))[regno] =
                                ((red & 0xf8) << 7) |
                                ((green & 0xf8) << 2) |
                                ((blue & 0xf8) >> 3);
-               }
-               break;
-       case 16:
-               if (regno < 16) {
+                       break;
+               case 11: /* RGB 565 */
                        ((u32 *)(p->pseudo_palette))[regno] =
                                ((red & 0xf8) << 8) |
                                ((green & 0xfc) << 3) |
                                ((blue & 0xf8) >> 3);
-               }
-               break;
-       case 24:
-               if (regno < 24) {
+                       break;
+               case 16: /* RGB 888 */
                        ((u32 *)(p->pseudo_palette))[regno] =
                                (red << 16)  |
                                (green << 8) |
                                (blue);
+                       break;
                }
-               break;
        }
+
        return 0;
 }