diff options
| author | Marcin Slusarz <marcin.slusarz@gmail.com> | 2010-02-17 19:04:00 +0100 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2010-02-25 15:09:07 +1000 |
| commit | df31ef4dbd48eca2772d8d88b12ee5eb5117c86e (patch) | |
| tree | a557c4b12dbac70cac62609f8bab24986e165869 /drivers/gpu | |
| parent | a1606a9596e54da90ad6209071b357a4c1b0fa82 (diff) | |
drm/nouveau: fix pramdac_table range checking
get_tmds_index_reg reads some value from stack when mlv happens
to be equal to size of pramdac_table array. Fix it.
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/nouveau/nouveau_bios.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c index 0e9cd1d49130..c1cee919b3cf 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c @@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv) dacoffset ^= 8; return 0x6808b0 + dacoffset; } else { - if (mlv > ARRAY_SIZE(pramdac_table)) { + if (mlv >= ARRAY_SIZE(pramdac_table)) { NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n", mlv); return 0; |