Skip to content

Commit

Permalink
drm/nouveau: fix pramdac_table range checking
Browse files Browse the repository at this point in the history
get_tmds_index_reg reads some value from stack when mlv happens
to be equal to size of pramdac_table array. Fix it.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
  • Loading branch information
Marcin Slusarz authored and Ben Skeggs committed Feb 25, 2010
1 parent a1606a9 commit df31ef4
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/gpu/drm/nouveau/nouveau_bios.c
Original file line number Diff line number Diff line change
Expand Up @@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv)
dacoffset ^= 8;
return 0x6808b0 + dacoffset;
} else {
if (mlv > ARRAY_SIZE(pramdac_table)) {
if (mlv >= ARRAY_SIZE(pramdac_table)) {
NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n",
mlv);
return 0;
Expand Down

0 comments on commit df31ef4

Please sign in to comment.