[PATCH] vesafb: Fix color palette handling

Fix out-of-bounds bug.  The pseudopalette has room only for 16 entries, thus,
write only the first 16 entries to the pseudopalette.

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 25 insertions, 31 deletions

diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
index 4f02615225ac..67e215443953 100644
--- a/drivers/video/vesafb.c
+++ b/drivers/video/vesafb.c
@@ -166,45 +166,39 @@ static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green,
         if (regno >= info->cmap.len)
                 return 1;
 
-        switch (info->var.bits_per_pixel) {
-        case 8:
+        if (info->var.bits_per_pixel == 8)
                 vesa_setpalette(regno,red,green,blue);
-                break;
-        case 16:
-                if (info->var.red.offset == 10) {
-                        /* 1:5:5:5 */
-                        ((u32*) (info->pseudo_palette))[regno] =        
+        else if (regno < 16) {
+                switch (info->var.bits_per_pixel) {
+                case 16:
+                        if (info->var.red.offset == 10) {
+                                /* 1:5:5:5 */
+                                ((u32*) (info->pseudo_palette))[regno] =
                                         ((red   & 0xf800) >>  1) |
                                         ((green & 0xf800) >>  6) |
                                         ((blue  & 0xf800) >> 11);
-                } else {
-                        /* 0:5:6:5 */
-                        ((u32*) (info->pseudo_palette))[regno] =        
+                        } else {
+                                /* 0:5:6:5 */
+                                ((u32*) (info->pseudo_palette))[regno] =
                                         ((red   & 0xf800)      ) |
                                         ((green & 0xfc00) >>  5) |
                                         ((blue  & 0xf800) >> 11);
+                        }
+                        break;
+                case 24:
+                case 32:
+                        red   >>= 8;
+                        green >>= 8;
+                        blue  >>= 8;
+                        ((u32 *)(info->pseudo_palette))[regno] =
+                                (red   << info->var.red.offset)   |
+                                (green << info->var.green.offset) |
+                                (blue  << info->var.blue.offset);
+                        break;
                 }
-                break;
-        case 24:
-                red   >>= 8;
-                green >>= 8;
-                blue  >>= 8;
-                ((u32 *)(info->pseudo_palette))[regno] =
-                        (red   << info->var.red.offset)   |
-                        (green << info->var.green.offset) |
-                        (blue  << info->var.blue.offset);
-                break;
-        case 32:
-                red   >>= 8;
-                green >>= 8;
-                blue  >>= 8;
-                ((u32 *)(info->pseudo_palette))[regno] =
-                        (red   << info->var.red.offset)   |
-                        (green << info->var.green.offset) |
-                        (blue  << info->var.blue.offset);
-                break;
-    }
-    return 0;
+        }
+
+        return 0;
 }
 
 static struct fb_ops vesafb_ops = {