From df31ef4dbd48eca2772d8d88b12ee5eb5117c86e Mon Sep 17 00:00:00 2001 From: Marcin Slusarz Date: Wed, 17 Feb 2010 19:04:00 +0100 Subject: [PATCH] drm/nouveau: fix pramdac_table range checking get_tmds_index_reg reads some value from stack when mlv happens to be equal to size of pramdac_table array. Fix it. Reported-by: Dan Carpenter Signed-off-by: Marcin Slusarz Signed-off-by: Francisco Jerez Signed-off-by: Ben Skeggs --- drivers/gpu/drm/nouveau/nouveau_bios.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c index 0e9cd1d..c1cee91 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c @@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv) dacoffset ^= 8; return 0x6808b0 + dacoffset; } else { - if (mlv > ARRAY_SIZE(pramdac_table)) { + if (mlv >= ARRAY_SIZE(pramdac_table)) { NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n", mlv); return 0; -- 2.7.4