From: Antonino A. Daplas <adaplas@gmail.com>
Date: Sat, 11 Mar 2006 11:27:26 +0000 (-0800)
Subject: [PATCH] intelfb: Fix buffer overrun
X-Git-Tag: v2.6.16-rc6~10
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d301524772be3eef5fae1bcd5ca76fac69bb3b6e;p=linux-2.6

[PATCH] intelfb: Fix buffer overrun

The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will
attempt to write more.

Coverity Bug 558

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---

diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 6b8bd3cdf9..995b47c165 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -1333,33 +1333,35 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
 	if (regno > 255)
 		return 1;
 
-	switch (dinfo->depth) {
-	case 8:
-		{
-			red >>= 8;
-			green >>= 8;
-			blue >>= 8;
+	if (dinfo->depth == 8) {
+		red >>= 8;
+		green >>= 8;
+		blue >>= 8;
+
+		intelfbhw_setcolreg(dinfo, regno, red, green, blue,
+				    transp);
+	}
 
-			intelfbhw_setcolreg(dinfo, regno, red, green, blue,
-					    transp);
+	if (regno < 16) {
+		switch (dinfo->depth) {
+		case 15:
+			dinfo->pseudo_palette[regno] = ((red & 0xf800) >>  1) |
+				((green & 0xf800) >>  6) |
+				((blue & 0xf800) >> 11);
+			break;
+		case 16:
+			dinfo->pseudo_palette[regno] = (red & 0xf800) |
+				((green & 0xfc00) >>  5) |
+				((blue  & 0xf800) >> 11);
+			break;
+		case 24:
+			dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
+				(green & 0xff00) |
+				((blue  & 0xff00) >> 8);
+			break;
 		}
-		break;
-	case 15:
-		dinfo->pseudo_palette[regno] = ((red & 0xf800) >>  1) |
-					       ((green & 0xf800) >>  6) |
-					       ((blue & 0xf800) >> 11);
-		break;
-	case 16:
-		dinfo->pseudo_palette[regno] = (red & 0xf800) |
-					       ((green & 0xfc00) >>  5) |
-					       ((blue  & 0xf800) >> 11);
-		break;
-	case 24:
-		dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
-					       (green & 0xff00) |
-					       ((blue  & 0xff00) >> 8);
-		break;
 	}
+
 	return 0;
 }