little patches for fbmem.c and offb.c

little patches for fbmem.c and offb.c

[Segher Boessenkool]

The fbmem.c bug made "less /proc/fb" segfault, as it made read()
returned more
bytes than were requested.

The offb.c bug caused /proc/fb output to be incorrect, and potentially
could cause kernel data structure corruption.

Enjoy,

Segher


--->SNIP HERE<---
diff -ur linux-2.2.19/drivers/video/fbmem.c linux-2.2.19-patched/drivers/video/fbmem.c
--- linux-2.2.19/drivers/video/fbmem.c	Sat May  5 15:41:06 2001
+++ linux-2.2.19-patched/drivers/video/fbmem.c	Sat May  5 15:41:06 2001
@@ -251,14 +251,16 @@
 {
 	struct fb_info **fi;
 
-	len = 0;
+	int buflen = 0;
 	for (fi = registered_fb; fi < &registered_fb[FB_MAX] && len < 4000; fi++)
 		if (*fi)
-			len += sprintf(buf + len, "%d %s\n",
+			buflen += sprintf(buf + buflen, "%d %s\n",
 				       GET_FB_IDX((*fi)->node),
 				       (*fi)->modename);
 	*start = buf + offset;
-	return len > offset ? len - offset : 0;
+
+	buflen = buflen > offset ? buflen - offset : 0;
+	return len < buflen ? len : buflen;
 }
 
 static ssize_t
diff -ur linux-2.2.19/drivers/video/offb.c linux-2.2.19-patched/drivers/video/offb.c
--- linux-2.2.19/drivers/video/offb.c	Sat May  5 16:17:28 2001
+++ linux-2.2.19-patched/drivers/video/offb.c	Sat May  5 16:07:41 2001
@@ -733,7 +733,7 @@
     disp->scrollmode = SCROLL_YREDRAW;
 
     strcpy(info->info.modename, "OFfb ");
-    strncat(info->info.modename, full_name, sizeof(info->info.modename));
+    strncat(info->info.modename, full_name, sizeof(info->info.modename)
- 6);
     info->info.node = -1;
     info->info.fbops = &offb_ops;
     info->info.disp = disp;
--->SNIP HERE<---