From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Subject: re: drm/nvd0/disp: initial crtc object implementation Date: Wed, 27 Nov 2013 00:30:27 +0300 Message-ID: <20131126213027.GA20597@elgon.mountain> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from aserp1040.oracle.com (aserp1040.oracle.com [141.146.126.69]) by gabe.freedesktop.org (Postfix) with ESMTP id A0D14FB6B7 for ; Tue, 26 Nov 2013 13:30:35 -0800 (PST) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces@lists.freedesktop.org Errors-To: dri-devel-bounces@lists.freedesktop.org To: bskeggs@redhat.com Cc: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org Hello Ben Skeggs, The patch 438d99e3b175: "drm/nvd0/disp: initial crtc object implementation" from Jul 5, 2011, leads to the following static checker warning: "drivers/gpu/drm/nouveau/nv50_display.c:1272 nv50_crtc_gamma_set() error: buffer overflow 'nv_crtc->lut.r' 256 <= 256" drivers/gpu/drm/nouveau/nv50_display.c 1263 static void 1264 nv50_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b, 1265 uint32_t start, uint32_t size) 1266 { 1267 struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc); 1268 u32 end = max(start + size, (u32)256); 1269 u32 i; 1270 1271 for (i = start; i < end; i++) { 1272 nv_crtc->lut.r[i] = r[i]; ^^^^^^^^ These arrays have 256 elements so going beyond seems like a bug. Should the end = max() be a min() or something? 1273 nv_crtc->lut.g[i] = g[i]; 1274 nv_crtc->lut.b[i] = b[i]; 1275 } 1276 1277 nv50_crtc_lut_load(crtc); 1278 } regards, dan carpenter