[PATCH] sisfb: Read buffer overflow
From: Roel Kluin <hidden>
Date: 2009-07-23 17:48:08
Subsystem:
framebuffer layer, the rest · Maintainers:
Helge Deller, Linus Torvalds
If called with mode_idx = 1, rate = 68, a read occurs from sisfb_vrate[-1].refresh. Signed-off-by: Roel Kluin <redacted> --- This presumes the conditional should be reversed, correct?
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index 636a785..35531d7 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c@@ -698,8 +698,8 @@ sisfb_search_refresh_rate(struct sis_video_info *ivideo, unsigned int rate, int rate, sisfb_vrate[i].refresh); ivideo->rate_idx = sisfb_vrate[i].idx; ivideo->refresh_rate = sisfb_vrate[i].refresh; - } else if(((rate - sisfb_vrate[i-1].refresh) <= 2) - && (sisfb_vrate[i].idx != 1)) { + } else if((sisfb_vrate[i].idx != 1) && + ((rate - sisfb_vrate[i-1].refresh) <= 2)) { DPRINTK("sisfb: Adjusting rate from %d down to %d\n", rate, sisfb_vrate[i-1].refresh); ivideo->rate_idx = sisfb_vrate[i-1].idx; ------------------------------------------------------------------------------