aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndrew Morton <akpm@linux-foundation.org>2008-02-06 04:39:15 -0500
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2008-02-06 13:41:16 -0500
commit0e9045494aa50f34b774a7449dde4128240a7b00 (patch)
tree9331f94260931db893420ed0b15b72b7b9e9cec0
parent050da932f857a7c83949147f3d22e7c02f4f3c91 (diff)
neofb: avoid overwriting fb_info fields
Fix bug identified by Marcio Buss in http://bugzilla.kernel.org/show_bug.cgi?id=9565 - neofb can overwrite a field in the fb_info struct. This fix will result in truncated device identification strings - perhaps fb_innfo.fix.id can be made larger? Cc: Marcio Buss <marciobuss@gmail.com> Cc: "Antonino A. Daplas" <adaplas@pol.net> Cc: Christian Trefzer <ctrefzer@gmx.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/video/neofb.c27
1 files changed, 18 insertions, 9 deletions
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c
index 4b6a99b5be0..5246b0402d7 100644
--- a/drivers/video/neofb.c
+++ b/drivers/video/neofb.c
@@ -2066,40 +2066,49 @@ static struct fb_info *__devinit neo_alloc_fb_info(struct pci_dev *dev, const st
2066 2066
2067 switch (info->fix.accel) { 2067 switch (info->fix.accel) {
2068 case FB_ACCEL_NEOMAGIC_NM2070: 2068 case FB_ACCEL_NEOMAGIC_NM2070:
2069 sprintf(info->fix.id, "MagicGraph 128"); 2069 snprintf(info->fix.id, sizeof(info->fix.id),
2070 "MagicGraph 128");
2070 break; 2071 break;
2071 case FB_ACCEL_NEOMAGIC_NM2090: 2072 case FB_ACCEL_NEOMAGIC_NM2090:
2072 sprintf(info->fix.id, "MagicGraph 128V"); 2073 snprintf(info->fix.id, sizeof(info->fix.id),
2074 "MagicGraph 128V");
2073 break; 2075 break;
2074 case FB_ACCEL_NEOMAGIC_NM2093: 2076 case FB_ACCEL_NEOMAGIC_NM2093:
2075 sprintf(info->fix.id, "MagicGraph 128ZV"); 2077 snprintf(info->fix.id, sizeof(info->fix.id),
2078 "MagicGraph 128ZV");
2076 break; 2079 break;
2077 case FB_ACCEL_NEOMAGIC_NM2097: 2080 case FB_ACCEL_NEOMAGIC_NM2097:
2078 sprintf(info->fix.id, "MagicGraph 128ZV+"); 2081 snprintf(info->fix.id, sizeof(info->fix.id),
2082 "MagicGraph 128ZV+");
2079 break; 2083 break;
2080 case FB_ACCEL_NEOMAGIC_NM2160: 2084 case FB_ACCEL_NEOMAGIC_NM2160:
2081 sprintf(info->fix.id, "MagicGraph 128XD"); 2085 snprintf(info->fix.id, sizeof(info->fix.id),
2086 "MagicGraph 128XD");
2082 break; 2087 break;
2083 case FB_ACCEL_NEOMAGIC_NM2200: 2088 case FB_ACCEL_NEOMAGIC_NM2200:
2084 sprintf(info->fix.id, "MagicGraph 256AV"); 2089 snprintf(info->fix.id, sizeof(info->fix.id),
2090 "MagicGraph 256AV");
2085 info->flags |= FBINFO_HWACCEL_IMAGEBLIT | 2091 info->flags |= FBINFO_HWACCEL_IMAGEBLIT |
2086 FBINFO_HWACCEL_COPYAREA | 2092 FBINFO_HWACCEL_COPYAREA |
2087 FBINFO_HWACCEL_FILLRECT; 2093 FBINFO_HWACCEL_FILLRECT;
2088 break; 2094 break;
2089 case FB_ACCEL_NEOMAGIC_NM2230: 2095 case FB_ACCEL_NEOMAGIC_NM2230:
2090 sprintf(info->fix.id, "MagicGraph 256AV+"); 2096 snprintf(info->fix.id, sizeof(info->fix.id),
2097 "MagicGraph 256AV+");
2091 info->flags |= FBINFO_HWACCEL_IMAGEBLIT | 2098 info->flags |= FBINFO_HWACCEL_IMAGEBLIT |
2092 FBINFO_HWACCEL_COPYAREA | 2099 FBINFO_HWACCEL_COPYAREA |
2093 FBINFO_HWACCEL_FILLRECT; 2100 FBINFO_HWACCEL_FILLRECT;
2094 break; 2101 break;
2095 case FB_ACCEL_NEOMAGIC_NM2360: 2102 case FB_ACCEL_NEOMAGIC_NM2360:
2096 sprintf(info->fix.id, "MagicGraph 256ZX"); 2103 snprintf(info->fix.id, sizeof(info->fix.id),
2104 "MagicGraph 256ZX");
2097 info->flags |= FBINFO_HWACCEL_IMAGEBLIT | 2105 info->flags |= FBINFO_HWACCEL_IMAGEBLIT |
2098 FBINFO_HWACCEL_COPYAREA | 2106 FBINFO_HWACCEL_COPYAREA |
2099 FBINFO_HWACCEL_FILLRECT; 2107 FBINFO_HWACCEL_FILLRECT;
2100 break; 2108 break;
2101 case FB_ACCEL_NEOMAGIC_NM2380: 2109 case FB_ACCEL_NEOMAGIC_NM2380:
2102 sprintf(info->fix.id, "MagicGraph 256XL+"); 2110 snprintf(info->fix.id, sizeof(info->fix.id),
2111 "MagicGraph 256XL+");
2103 info->flags |= FBINFO_HWACCEL_IMAGEBLIT | 2112 info->flags |= FBINFO_HWACCEL_IMAGEBLIT |
2104 FBINFO_HWACCEL_COPYAREA | 2113 FBINFO_HWACCEL_COPYAREA |
2105 FBINFO_HWACCEL_FILLRECT; 2114 FBINFO_HWACCEL_FILLRECT;