iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH] tdfxfb: Fix buffer overrun

Browse Source 
The pseudo_palette has room only for 16 entries, but tdfxfb_setcolreg may
attempt to write more.

Coverity Bug 557

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Antonino A. Daplas 2006-03-11 03:27:26 -08:00 committed by Linus Torvalds
parent d301524772
commit 54243cefdd
1 changed files with 23 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
drivers/video/tdfxfb.c
View File

@ -786,28 +786,32 @@ static int tdfxfb_setcolreg(unsigned regno, unsigned red, unsigned green,
if (regno >= info->cmap.len || regno > 255) return 1;
switch (info->fix.visual) {
case FB_VISUAL_PSEUDOCOLOR:
rgbcol =(((u32)red & 0xff00) << 8) |
(((u32)green & 0xff00) << 0) |
(((u32)blue & 0xff00) >> 8);
do_setpalentry(par, regno, rgbcol);
break;
/* Truecolor has no hardware color palettes. */
case FB_VISUAL_TRUECOLOR:
case FB_VISUAL_PSEUDOCOLOR:
rgbcol =(((u32)red & 0xff00) << 8) |
(((u32)green & 0xff00) << 0) |
(((u32)blue & 0xff00) >> 8);
do_setpalentry(par, regno, rgbcol);
break;
/* Truecolor has no hardware color palettes. */
case FB_VISUAL_TRUECOLOR:
if (regno < 16) {
rgbcol = (CNVT_TOHW( red, info->var.red.length) <<
info->var.red.offset) |
(CNVT_TOHW( green, info->var.green.length) <<
info->var.green.offset) |
(CNVT_TOHW( blue, info->var.blue.length) <<
info->var.blue.offset) |
(CNVT_TOHW( transp, info->var.transp.length) <<
info->var.transp.offset);
par->palette[regno] = rgbcol;
break;
default:
DPRINTK("bad depth %u\n", info->var.bits_per_pixel);
break;
(CNVT_TOHW( green, info->var.green.length) <<
info->var.green.offset) |
(CNVT_TOHW( blue, info->var.blue.length) <<
info->var.blue.offset) |
(CNVT_TOHW( transp, info->var.transp.length) <<
info->var.transp.offset);
par->palette[regno] = rgbcol;
}
break;
default:
DPRINTK("bad depth %u\n", info->var.bits_per_pixel);
break;
}
return 0;
}