From 7592181005261c3d90398375ab6922f56cdd2bad Mon Sep 17 00:00:00 2001 From: "Antonino A. Daplas" Date: Tue, 17 Jul 2007 04:05:35 -0700 Subject: [PATCH] cyblafb: fix pseudo_palette array overrun in setcolreg The pseudo_palette has only 16 elements. Do not write if regno (the array index) is more than 15. Signed-off-by: Antonino Daplas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/video/cyblafb.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/video/cyblafb.c b/drivers/video/cyblafb.c index 94a66c2d2c..e23324d10b 100644 --- a/drivers/video/cyblafb.c +++ b/drivers/video/cyblafb.c @@ -1068,15 +1068,18 @@ static int cyblafb_setcolreg(unsigned regno, unsigned red, unsigned green, out8(0x3C9, green >> 10); out8(0x3C9, blue >> 10); - } else if (bpp == 16) // RGB 565 - ((u32 *) info->pseudo_palette)[regno] = - (red & 0xF800) | - ((green & 0xFC00) >> 5) | ((blue & 0xF800) >> 11); - else if (bpp == 32) // ARGB 8888 - ((u32 *) info->pseudo_palette)[regno] = - ((transp & 0xFF00) << 16) | - ((red & 0xFF00) << 8) | - ((green & 0xFF00)) | ((blue & 0xFF00) >> 8); + } else if (regno < 16) { + if (bpp == 16) // RGB 565 + ((u32 *) info->pseudo_palette)[regno] = + (red & 0xF800) | + ((green & 0xFC00) >> 5) | + ((blue & 0xF800) >> 11); + else if (bpp == 32) // ARGB 8888 + ((u32 *) info->pseudo_palette)[regno] = + ((transp & 0xFF00) << 16) | + ((red & 0xFF00) << 8) | + ((green & 0xFF00)) | ((blue & 0xFF00) >> 8); + } return 0; } -- 2.39.5