diff options
| author | Antonino A. Daplas <adaplas@gmail.com> | 2006-03-11 03:27:28 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-03-11 09:19:36 -0800 |
| commit | ed62178589929d248a0aaf4018ca3867e2f96d9d (patch) | |
| tree | 3dce07a9f0fa8bd6f5758174a1db80a090ea368b | |
| parent | 8e6509876c5cb079f56dbe334aafaae9a293c886 (diff) | |
| download | op-kernel-dev-ed62178589929d248a0aaf4018ca3867e2f96d9d.zip op-kernel-dev-ed62178589929d248a0aaf4018ca3867e2f96d9d.tar.gz | |
[PATCH] radeonfb: Fix static array overrun
radeonfb_parse_monitor_layout() will produce an array overrun if passed with a
substring of length higher than 4 (ie, "XXXXX,YYYYYY").
Coverity Bug 494
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | drivers/video/aty/radeon_monitor.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/video/aty/radeon_monitor.c b/drivers/video/aty/radeon_monitor.c index 7f9838d..98c05bc 100644 --- a/drivers/video/aty/radeon_monitor.c +++ b/drivers/video/aty/radeon_monitor.c @@ -396,6 +396,10 @@ static int __devinit radeon_parse_monitor_layout(struct radeonfb_info *rinfo, s1[i] = *s; i++; } + + if (i > 4) + i = 4; + } while (*s++); if (second) s2[i] = 0; |
