system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-24 21:38:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

drm/nouveau: fix pramdac_table range checking

Browse source 
get_tmds_index_reg reads some value from stack when mlv happens
to be equal to size of pramdac_table array. Fix it.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This commit is contained in:
Marcin Slusarz 2010-02-17 19:04:00 +01:00 committed by Ben Skeggs
parent a1606a9596
commit df31ef4dbd
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/gpu/drm/nouveau/nouveau_bios.c
View file

@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv)
dacoffset ^= 8;
return 0x6808b0 + dacoffset;
} else {
if (mlv > ARRAY_SIZE(pramdac_table)) {
if (mlv >= ARRAY_SIZE(pramdac_table)) {
NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n",
mlv);
return 0;