[PATCH] Fix pseudo_palette setup in asiliantfb_setcolreg()

The setcolreg function will attempt to write 24 color entries to the
pseudo_pallette.  However, the pseudo_palette has only space for 16 entries.

Thanks to Atsushi Nemoto for reporting this bug.

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 9 insertions, 12 deletions

diff --git a/drivers/video/asiliantfb.c b/drivers/video/asiliantfb.c
index 69f75547865d..c924d81f7978 100644
--- a/drivers/video/asiliantfb.c
+++ b/drivers/video/asiliantfb.c
@@ -322,32 +322,29 @@ static int asiliantfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
         writeb(green, mmio_base + 0x791);
         writeb(blue, mmio_base + 0x791);
 
-        switch(p->var.bits_per_pixel) {
-        case 15:
-                if (regno < 16) {
+        if (regno < 16) {
+                switch(p->var.red.offset) {
+                case 10: /* RGB 555 */
                         ((u32 *)(p->pseudo_palette))[regno] =
                                 ((red & 0xf8) << 7) |
                                 ((green & 0xf8) << 2) |
                                 ((blue & 0xf8) >> 3);
-                }
-                break;
-        case 16:
-                if (regno < 16) {
+                        break;
+                case 11: /* RGB 565 */
                         ((u32 *)(p->pseudo_palette))[regno] =
                                 ((red & 0xf8) << 8) |
                                 ((green & 0xfc) << 3) |
                                 ((blue & 0xf8) >> 3);
-                }
-                break;
-        case 24:
-                if (regno < 24) {
+                        break;
+                case 16: /* RGB 888 */
                         ((u32 *)(p->pseudo_palette))[regno] =
                                 (red << 16)  |
                                 (green << 8) |
                                 (blue);
+                        break;
                 }
-                break;
         }
+
         return 0;
 }