github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 18:21:24 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

staging: sm750fb: fix off-by-one in lynxfb_ops_setcolreg

Browse Source 
The bounds check used regno > 256 instead of regno >= 256,
allowing regno == 256. Valid indices are 0–255, resulting
in an out-of-bounds write.

Also remove the regno < 256 check in the truecolor path,
as it is always true with the corrected guard.

Signed-off-by: Ahmet Sezgin Duran <ahmet@sezginduran.net>
Link: https://patch.msgid.link/20260408181210.9672-1-ahmet@sezginduran.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ahmet Sezgin Duran 2026-04-08 18:12:10 +00:00 committed by Greg Kroah-Hartman
parent 94c938a0c1
commit 1121e30840
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/staging/sm750fb/sm750.c
View File

@ -531,7 +531,7 @@ static int lynxfb_ops_setcolreg(unsigned int regno,
var = &info->var;
ret = 0;
if (regno > 256) {
if (regno >= 256) {
dev_err(info->device, "regno = %d\n", regno);
return -EINVAL;
}
@ -553,7 +553,7 @@ static int lynxfb_ops_setcolreg(unsigned int regno,
goto exit;
}
if (info->fix.visual == FB_VISUAL_TRUECOLOR && regno < 256) {
if (info->fix.visual == FB_VISUAL_TRUECOLOR) {
u32 val;
if (var->bits_per_pixel == 16 ||