From patchwork Sat Feb 20 18:49:43 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: chris.nicholson@cnick.org.uk X-Patchwork-Id: 81002 Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o1LBb6Dk003102 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 21 Feb 2010 11:37:43 GMT Received: from localhost ([127.0.0.1] helo=sfs-ml-2.v29.ch3.sourceforge.com) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1NjA6N-0006pN-7S; Sun, 21 Feb 2010 11:35:55 +0000 Received: from sfi-mx-3.v28.ch3.sourceforge.com ([172.29.28.123] helo=mx.sourceforge.net) by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1Niuag-0004NA-Q4 for dri-devel@lists.sourceforge.net; Sat, 20 Feb 2010 19:02:10 +0000 X-ACL-Warn: Received: from 87-194-149-168.bethere.co.uk ([87.194.149.168] helo=svr2.cnick.org.uk) by sfi-mx-3.v28.ch3.sourceforge.com with esmtp (Exim 4.69) id 1Niuaf-0006Mq-9O for dri-devel@lists.sourceforge.net; Sat, 20 Feb 2010 19:02:10 +0000 Received: from localhost.localdomain ([86.154.74.28]) by svr2.cnick.org.uk with Microsoft SMTPSVC(6.0.3790.3959); Sat, 20 Feb 2010 18:48:47 +0000 From: chris.nicholson@cnick.org.uk To: airlied@linux.ie, bskeggs@redhat.com, madman2003@gmail.com, koriakin@0x04.net, currojerez@riseup.net, tacconet@libero.it Subject: [PATCH] Gpu: drm: fix buffer overflow in nouveau_bios.c Date: Sat, 20 Feb 2010 18:49:43 +0000 Message-Id: <1266691783-25029-1-git-send-email-chris.nicholson@cnick.org.uk> X-Mailer: git-send-email 1.6.6 X-OriginalArrivalTime: 20 Feb 2010 18:48:47.0653 (UTC) FILETIME=[55E93550:01CAB25D] X-Spam-Score: -0.7 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 1.6 TVD_RCVD_IP TVD_RCVD_IP 1.0 RDNS_DYNAMIC Delivered to trusted network by host with dynamic-looking rDNS -3.3 AWL AWL: From: address is in the auto white-list X-Headers-End: 1Niuaf-0006Mq-9O X-Mailman-Approved-At: Sun, 21 Feb 2010 11:35:53 +0000 Cc: dri-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org X-BeenThere: dri-devel@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.sourceforge.net X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Sun, 21 Feb 2010 11:37:43 +0000 (UTC) diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c index 0e9cd1d..c1cee91 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c @@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv) dacoffset ^= 8; return 0x6808b0 + dacoffset; } else { - if (mlv > ARRAY_SIZE(pramdac_table)) { + if (mlv >= ARRAY_SIZE(pramdac_table)) { NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n", mlv); return 0;