From 08a498de79727d63a011f2583e9aba4d3083c3a0 Mon Sep 17 00:00:00 2001 From: "Antonino A. Daplas" Date: Tue, 17 Jul 2007 04:05:45 -0700 Subject: matroxfb: color setting fixes - the pseudo_palette is only 16 elements long. - do not write to the pseudo_palette if regno (array index) is more than 15 - remove code that writes to the 17th entry of the pseudo_palette Signed-off-by: Antonino Daplas Acked-by: Petr Vandrovec Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/video/matrox/matroxfb_base.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers/video/matrox/matroxfb_base.c') diff --git a/drivers/video/matrox/matroxfb_base.c b/drivers/video/matrox/matroxfb_base.c index 886e475f22f2..86ca7b179000 100644 --- a/drivers/video/matrox/matroxfb_base.c +++ b/drivers/video/matrox/matroxfb_base.c @@ -679,6 +679,8 @@ static int matroxfb_setcolreg(unsigned regno, unsigned red, unsigned green, mga_outb(M_DAC_VAL, blue); break; case 16: + if (regno >= 16) + break; { u_int16_t col = (red << ACCESS_FBINFO(fbcon).var.red.offset) | @@ -690,6 +692,8 @@ static int matroxfb_setcolreg(unsigned regno, unsigned red, unsigned green, break; case 24: case 32: + if (regno >= 16) + break; ACCESS_FBINFO(cmap[regno]) = (red << ACCESS_FBINFO(fbcon).var.red.offset) | (green << ACCESS_FBINFO(fbcon).var.green.offset) | -- cgit v1.2.3