matroxfb: color setting fixes

- the pseudo_palette is only 16 elements long.
- do not write to the pseudo_palette if regno (array index) is more than 15
- remove code that writes to the 17th entry of the pseudo_palette

Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Acked-by: Petr Vandrovec <vandrove@vc.cvut.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 4 insertions, 0 deletions

diff --git a/drivers/video/matrox/matroxfb_base.c b/drivers/video/matrox/matroxfb_base.c
index 886e475f22f2..86ca7b179000 100644
--- a/drivers/video/matrox/matroxfb_base.c
+++ b/drivers/video/matrox/matroxfb_base.c
@@ -679,6 +679,8 @@ static int matroxfb_setcolreg(unsigned regno, unsigned red, unsigned green,
                 mga_outb(M_DAC_VAL, blue);
                 break;
         case 16:
+                if (regno >= 16)
+                        break;
                 {
                         u_int16_t col =
                                 (red << ACCESS_FBINFO(fbcon).var.red.offset)     |
@@ -690,6 +692,8 @@ static int matroxfb_setcolreg(unsigned regno, unsigned red, unsigned green,
                 break;
         case 24:
         case 32:
+                if (regno >= 16)
+                        break;
                 ACCESS_FBINFO(cmap[regno]) =
                         (red   << ACCESS_FBINFO(fbcon).var.red.offset)   |
                         (green << ACCESS_FBINFO(fbcon).var.green.offset) |