macfb: fix pseudo_palette size and overrun
- the pseudo_palette is only 16 elements long. - do not write to the pseudo_palette if regno (array index) is more than 15. Signed-off-by: Antonino Daplas <adaplas@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
9058be43cf
commit
24fc72239a
|
@ -170,7 +170,7 @@ static struct fb_fix_screeninfo macfb_fix = {
|
||||||
};
|
};
|
||||||
|
|
||||||
static struct fb_info fb_info;
|
static struct fb_info fb_info;
|
||||||
static u32 pseudo_palette[17];
|
static u32 pseudo_palette[16];
|
||||||
static int inverse = 0;
|
static int inverse = 0;
|
||||||
static int vidtest = 0;
|
static int vidtest = 0;
|
||||||
|
|
||||||
|
@ -529,56 +529,63 @@ static int macfb_setcolreg(unsigned regno, unsigned red, unsigned green,
|
||||||
if (regno >= fb_info->cmap.len)
|
if (regno >= fb_info->cmap.len)
|
||||||
return 1;
|
return 1;
|
||||||
|
|
||||||
switch (fb_info->var.bits_per_pixel) {
|
if (fb_info->var.bits_per_pixel <= 8) {
|
||||||
case 1:
|
switch (fb_info->var.bits_per_pixel) {
|
||||||
/* We shouldn't get here */
|
case 1:
|
||||||
break;
|
/* We shouldn't get here */
|
||||||
case 2:
|
break;
|
||||||
case 4:
|
case 2:
|
||||||
case 8:
|
case 4:
|
||||||
if (macfb_setpalette)
|
case 8:
|
||||||
macfb_setpalette(regno, red, green, blue, fb_info);
|
if (macfb_setpalette)
|
||||||
else
|
macfb_setpalette(regno, red, green, blue,
|
||||||
return 1;
|
fb_info);
|
||||||
break;
|
else
|
||||||
case 16:
|
return 1;
|
||||||
if (fb_info->var.red.offset == 10) {
|
break;
|
||||||
/* 1:5:5:5 */
|
}
|
||||||
((u32*) (fb_info->pseudo_palette))[regno] =
|
} else if (regno < 16) {
|
||||||
|
switch (fb_info->var.bits_per_pixel) {
|
||||||
|
case 16:
|
||||||
|
if (fb_info->var.red.offset == 10) {
|
||||||
|
/* 1:5:5:5 */
|
||||||
|
((u32*) (fb_info->pseudo_palette))[regno] =
|
||||||
((red & 0xf800) >> 1) |
|
((red & 0xf800) >> 1) |
|
||||||
((green & 0xf800) >> 6) |
|
((green & 0xf800) >> 6) |
|
||||||
((blue & 0xf800) >> 11) |
|
((blue & 0xf800) >> 11) |
|
||||||
((transp != 0) << 15);
|
((transp != 0) << 15);
|
||||||
} else {
|
} else {
|
||||||
/* 0:5:6:5 */
|
/* 0:5:6:5 */
|
||||||
((u32*) (fb_info->pseudo_palette))[regno] =
|
((u32*) (fb_info->pseudo_palette))[regno] =
|
||||||
((red & 0xf800) ) |
|
((red & 0xf800) ) |
|
||||||
((green & 0xfc00) >> 5) |
|
((green & 0xfc00) >> 5) |
|
||||||
((blue & 0xf800) >> 11);
|
((blue & 0xf800) >> 11);
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
/* I'm pretty sure that one or the other of these
|
||||||
|
doesn't exist on 68k Macs */
|
||||||
|
case 24:
|
||||||
|
red >>= 8;
|
||||||
|
green >>= 8;
|
||||||
|
blue >>= 8;
|
||||||
|
((u32 *)(fb_info->pseudo_palette))[regno] =
|
||||||
|
(red << fb_info->var.red.offset) |
|
||||||
|
(green << fb_info->var.green.offset) |
|
||||||
|
(blue << fb_info->var.blue.offset);
|
||||||
|
break;
|
||||||
|
case 32:
|
||||||
|
red >>= 8;
|
||||||
|
green >>= 8;
|
||||||
|
blue >>= 8;
|
||||||
|
((u32 *)(fb_info->pseudo_palette))[regno] =
|
||||||
|
(red << fb_info->var.red.offset) |
|
||||||
|
(green << fb_info->var.green.offset) |
|
||||||
|
(blue << fb_info->var.blue.offset);
|
||||||
|
break;
|
||||||
}
|
}
|
||||||
break;
|
}
|
||||||
/* I'm pretty sure that one or the other of these
|
|
||||||
doesn't exist on 68k Macs */
|
return 0;
|
||||||
case 24:
|
|
||||||
red >>= 8;
|
|
||||||
green >>= 8;
|
|
||||||
blue >>= 8;
|
|
||||||
((u32 *)(fb_info->pseudo_palette))[regno] =
|
|
||||||
(red << fb_info->var.red.offset) |
|
|
||||||
(green << fb_info->var.green.offset) |
|
|
||||||
(blue << fb_info->var.blue.offset);
|
|
||||||
break;
|
|
||||||
case 32:
|
|
||||||
red >>= 8;
|
|
||||||
green >>= 8;
|
|
||||||
blue >>= 8;
|
|
||||||
((u32 *)(fb_info->pseudo_palette))[regno] =
|
|
||||||
(red << fb_info->var.red.offset) |
|
|
||||||
(green << fb_info->var.green.offset) |
|
|
||||||
(blue << fb_info->var.blue.offset);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
return 0;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static struct fb_ops macfb_ops = {
|
static struct fb_ops macfb_ops = {
|
||||||
|
|
Reference in New Issue