drm/nouveau: fix pramdac_table range checking
get_tmds_index_reg reads some value from stack when mlv happens to be equal to size of pramdac_table array. Fix it. Reported-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com> Signed-off-by: Francisco Jerez <currojerez@riseup.net> Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
This commit is contained in:
parent
a1606a9596
commit
df31ef4dbd
|
@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv)
|
||||||
dacoffset ^= 8;
|
dacoffset ^= 8;
|
||||||
return 0x6808b0 + dacoffset;
|
return 0x6808b0 + dacoffset;
|
||||||
} else {
|
} else {
|
||||||
if (mlv > ARRAY_SIZE(pramdac_table)) {
|
if (mlv >= ARRAY_SIZE(pramdac_table)) {
|
||||||
NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n",
|
NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n",
|
||||||
mlv);
|
mlv);
|
||||||
return 0;
|
return 0;
|
||||||
|
|
Loading…
Reference in New Issue