* [PATCH 13/18] intelfb: Fix buffer overrun
@ 2006-03-11 1:51 Antonino A. Daplas
0 siblings, 0 replies; only message in thread
From: Antonino A. Daplas @ 2006-03-11 1:51 UTC (permalink / raw)
To: Andrew Morton; +Cc: Linux Fbdev development list, Sylvain Meyer
The pseudo_palette has room only for 16 entries, but intelfb_setcolreg
will attempt to write more.
Coverity Bug 558
Signed-off-by: Antonino Daplas <adaplas@pol.net>
---
drivers/video/intelfb/intelfbdrv.c | 50 +++++++++++++++++++-----------------
1 files changed, 26 insertions(+), 24 deletions(-)
diff --git a/drivers/video/intelfb/intelfbdrv.c b/drivers/video/intelfb/intelfbdrv.c
index 6b8bd3c..995b47c 100644
--- a/drivers/video/intelfb/intelfbdrv.c
+++ b/drivers/video/intelfb/intelfbdrv.c
@@ -1333,33 +1333,35 @@ intelfb_setcolreg(unsigned regno, unsign
if (regno > 255)
return 1;
- switch (dinfo->depth) {
- case 8:
- {
- red >>= 8;
- green >>= 8;
- blue >>= 8;
+ if (dinfo->depth == 8) {
+ red >>= 8;
+ green >>= 8;
+ blue >>= 8;
- intelfbhw_setcolreg(dinfo, regno, red, green, blue,
- transp);
+ intelfbhw_setcolreg(dinfo, regno, red, green, blue,
+ transp);
+ }
+
+ if (regno < 16) {
+ switch (dinfo->depth) {
+ case 15:
+ dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) |
+ ((green & 0xf800) >> 6) |
+ ((blue & 0xf800) >> 11);
+ break;
+ case 16:
+ dinfo->pseudo_palette[regno] = (red & 0xf800) |
+ ((green & 0xfc00) >> 5) |
+ ((blue & 0xf800) >> 11);
+ break;
+ case 24:
+ dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
+ (green & 0xff00) |
+ ((blue & 0xff00) >> 8);
+ break;
}
- break;
- case 15:
- dinfo->pseudo_palette[regno] = ((red & 0xf800) >> 1) |
- ((green & 0xf800) >> 6) |
- ((blue & 0xf800) >> 11);
- break;
- case 16:
- dinfo->pseudo_palette[regno] = (red & 0xf800) |
- ((green & 0xfc00) >> 5) |
- ((blue & 0xf800) >> 11);
- break;
- case 24:
- dinfo->pseudo_palette[regno] = ((red & 0xff00) << 8) |
- (green & 0xff00) |
- ((blue & 0xff00) >> 8);
- break;
}
+
return 0;
}
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2006-03-11 2:23 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-03-11 1:51 [PATCH 13/18] intelfb: Fix buffer overrun Antonino A. Daplas
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.