diff options
author | Andrew Morton <akpm@linux-foundation.org> | 2008-02-06 04:39:15 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2008-02-06 13:41:16 -0500 |
commit | 0e9045494aa50f34b774a7449dde4128240a7b00 (patch) | |
tree | 9331f94260931db893420ed0b15b72b7b9e9cec0 | |
parent | 050da932f857a7c83949147f3d22e7c02f4f3c91 (diff) |
neofb: avoid overwriting fb_info fields
Fix bug identified by Marcio Buss in
http://bugzilla.kernel.org/show_bug.cgi?id=9565 - neofb can overwrite a field
in the fb_info struct.
This fix will result in truncated device identification strings - perhaps
fb_innfo.fix.id can be made larger?
Cc: Marcio Buss <marciobuss@gmail.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: Christian Trefzer <ctrefzer@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r-- | drivers/video/neofb.c | 27 |
1 files changed, 18 insertions, 9 deletions
diff --git a/drivers/video/neofb.c b/drivers/video/neofb.c index 4b6a99b5be0d..5246b0402d76 100644 --- a/drivers/video/neofb.c +++ b/drivers/video/neofb.c | |||
@@ -2066,40 +2066,49 @@ static struct fb_info *__devinit neo_alloc_fb_info(struct pci_dev *dev, const st | |||
2066 | 2066 | ||
2067 | switch (info->fix.accel) { | 2067 | switch (info->fix.accel) { |
2068 | case FB_ACCEL_NEOMAGIC_NM2070: | 2068 | case FB_ACCEL_NEOMAGIC_NM2070: |
2069 | sprintf(info->fix.id, "MagicGraph 128"); | 2069 | snprintf(info->fix.id, sizeof(info->fix.id), |
2070 | "MagicGraph 128"); | ||
2070 | break; | 2071 | break; |
2071 | case FB_ACCEL_NEOMAGIC_NM2090: | 2072 | case FB_ACCEL_NEOMAGIC_NM2090: |
2072 | sprintf(info->fix.id, "MagicGraph 128V"); | 2073 | snprintf(info->fix.id, sizeof(info->fix.id), |
2074 | "MagicGraph 128V"); | ||
2073 | break; | 2075 | break; |
2074 | case FB_ACCEL_NEOMAGIC_NM2093: | 2076 | case FB_ACCEL_NEOMAGIC_NM2093: |
2075 | sprintf(info->fix.id, "MagicGraph 128ZV"); | 2077 | snprintf(info->fix.id, sizeof(info->fix.id), |
2078 | "MagicGraph 128ZV"); | ||
2076 | break; | 2079 | break; |
2077 | case FB_ACCEL_NEOMAGIC_NM2097: | 2080 | case FB_ACCEL_NEOMAGIC_NM2097: |
2078 | sprintf(info->fix.id, "MagicGraph 128ZV+"); | 2081 | snprintf(info->fix.id, sizeof(info->fix.id), |
2082 | "MagicGraph 128ZV+"); | ||
2079 | break; | 2083 | break; |
2080 | case FB_ACCEL_NEOMAGIC_NM2160: | 2084 | case FB_ACCEL_NEOMAGIC_NM2160: |
2081 | sprintf(info->fix.id, "MagicGraph 128XD"); | 2085 | snprintf(info->fix.id, sizeof(info->fix.id), |
2086 | "MagicGraph 128XD"); | ||
2082 | break; | 2087 | break; |
2083 | case FB_ACCEL_NEOMAGIC_NM2200: | 2088 | case FB_ACCEL_NEOMAGIC_NM2200: |
2084 | sprintf(info->fix.id, "MagicGraph 256AV"); | 2089 | snprintf(info->fix.id, sizeof(info->fix.id), |
2090 | "MagicGraph 256AV"); | ||
2085 | info->flags |= FBINFO_HWACCEL_IMAGEBLIT | | 2091 | info->flags |= FBINFO_HWACCEL_IMAGEBLIT | |
2086 | FBINFO_HWACCEL_COPYAREA | | 2092 | FBINFO_HWACCEL_COPYAREA | |
2087 | FBINFO_HWACCEL_FILLRECT; | 2093 | FBINFO_HWACCEL_FILLRECT; |
2088 | break; | 2094 | break; |
2089 | case FB_ACCEL_NEOMAGIC_NM2230: | 2095 | case FB_ACCEL_NEOMAGIC_NM2230: |
2090 | sprintf(info->fix.id, "MagicGraph 256AV+"); | 2096 | snprintf(info->fix.id, sizeof(info->fix.id), |
2097 | "MagicGraph 256AV+"); | ||
2091 | info->flags |= FBINFO_HWACCEL_IMAGEBLIT | | 2098 | info->flags |= FBINFO_HWACCEL_IMAGEBLIT | |
2092 | FBINFO_HWACCEL_COPYAREA | | 2099 | FBINFO_HWACCEL_COPYAREA | |
2093 | FBINFO_HWACCEL_FILLRECT; | 2100 | FBINFO_HWACCEL_FILLRECT; |
2094 | break; | 2101 | break; |
2095 | case FB_ACCEL_NEOMAGIC_NM2360: | 2102 | case FB_ACCEL_NEOMAGIC_NM2360: |
2096 | sprintf(info->fix.id, "MagicGraph 256ZX"); | 2103 | snprintf(info->fix.id, sizeof(info->fix.id), |
2104 | "MagicGraph 256ZX"); | ||
2097 | info->flags |= FBINFO_HWACCEL_IMAGEBLIT | | 2105 | info->flags |= FBINFO_HWACCEL_IMAGEBLIT | |
2098 | FBINFO_HWACCEL_COPYAREA | | 2106 | FBINFO_HWACCEL_COPYAREA | |
2099 | FBINFO_HWACCEL_FILLRECT; | 2107 | FBINFO_HWACCEL_FILLRECT; |
2100 | break; | 2108 | break; |
2101 | case FB_ACCEL_NEOMAGIC_NM2380: | 2109 | case FB_ACCEL_NEOMAGIC_NM2380: |
2102 | sprintf(info->fix.id, "MagicGraph 256XL+"); | 2110 | snprintf(info->fix.id, sizeof(info->fix.id), |
2111 | "MagicGraph 256XL+"); | ||
2103 | info->flags |= FBINFO_HWACCEL_IMAGEBLIT | | 2112 | info->flags |= FBINFO_HWACCEL_IMAGEBLIT | |
2104 | FBINFO_HWACCEL_COPYAREA | | 2113 | FBINFO_HWACCEL_COPYAREA | |
2105 | FBINFO_HWACCEL_FILLRECT; | 2114 | FBINFO_HWACCEL_FILLRECT; |