From patchwork Sun Mar 28 11:23:09 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 88766 Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o2SCWkiE015579 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Sun, 28 Mar 2010 12:33:22 GMT Received: from localhost ([127.0.0.1] helo=sfs-ml-4.v29.ch3.sourceforge.com) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1NvreH-0004VX-6e; Sun, 28 Mar 2010 12:31:25 +0000 Received: from sfi-mx-3.v28.ch3.sourceforge.com ([172.29.28.123] helo=mx.sourceforge.net) by sfs-ml-3.v29.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1NvqaT-0007Ba-4e for dri-devel@lists.sourceforge.net; Sun, 28 Mar 2010 11:23:25 +0000 Received-SPF: pass (sfi-mx-3.v28.ch3.sourceforge.com: domain of gmail.com designates 209.85.218.218 as permitted sender) client-ip=209.85.218.218; envelope-from=error27@gmail.com; helo=mail-bw0-f218.google.com; Received: from mail-bw0-f218.google.com ([209.85.218.218]) by sfi-mx-3.v28.ch3.sourceforge.com with esmtp (Exim 4.69) id 1NvqaQ-0003wt-So for dri-devel@lists.sourceforge.net; Sun, 28 Mar 2010 11:23:25 +0000 Received: by bwz10 with SMTP id 10so12802788bwz.2 for ; Sun, 28 Mar 2010 04:23:16 -0700 (PDT) Received: by 10.204.146.135 with SMTP id h7mr1826395bkv.200.1269775396732; Sun, 28 Mar 2010 04:23:16 -0700 (PDT) Received: from bicker ([196.43.68.224]) by mx.google.com with ESMTPS id l1sm27164808bkl.14.2010.03.28.04.23.13 (version=TLSv1/SSLv3 cipher=RC4-MD5); Sun, 28 Mar 2010 04:23:16 -0700 (PDT) Date: Sun, 28 Mar 2010 14:23:09 +0300 From: Dan Carpenter To: Dave Airlie Subject: [patch] radeon: range check issues Message-ID: <20100328112309.GJ5069@bicker> Mail-Followup-To: Dan Carpenter , Dave Airlie , Alex Deucher , Jerome Glisse , =?utf-8?B?UmFmYcWCIE1pxYJlY2tp?= , dri-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) X-Spam-Score: 1.9 (+) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain 2.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see ] 1.5 RCVD_IN_PSBL RBL: Received via a relay in PSBL [196.43.68.224 listed in psbl.surriel.com] -0.0 SPF_PASS SPF: sender matches SPF record -0.0 DKIM_VERIFIED Domain Keys Identified Mail: signature passes verification 0.0 DKIM_SIGNED Domain Keys Identified Mail: message has a signature 1.5 SF_NO_SPF_SPAM SF_NO_SPF_SPAM -1.7 AWL AWL: From: address is in the auto white-list X-Headers-End: 1NvqaQ-0003wt-So X-Mailman-Approved-At: Sun, 28 Mar 2010 12:31:23 +0000 Cc: Alex Deucher , Jerome Glisse , dri-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org X-BeenThere: dri-devel@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.sourceforge.net X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Sun, 28 Mar 2010 12:33:22 +0000 (UTC) diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h index 6732b5d..27e2c71 100644 --- a/drivers/gpu/drm/radeon/atombios.h +++ b/drivers/gpu/drm/radeon/atombios.h @@ -2912,7 +2912,7 @@ typedef struct _ATOM_ANALOG_TV_INFO_V1_2 UCHAR ucTV_BootUpDefaultStandard; UCHAR ucExt_TV_ASIC_ID; UCHAR ucExt_TV_ASIC_SlaveAddr; - ATOM_DTD_FORMAT aModeTimings[MAX_SUPPORTED_TV_TIMING]; + ATOM_DTD_FORMAT aModeTimings[MAX_SUPPORTED_TV_TIMING_V1_2]; }ATOM_ANALOG_TV_INFO_V1_2; typedef struct _ATOM_DPCD_INFO diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c index 93783b1..bdc0ab3 100644 --- a/drivers/gpu/drm/radeon/radeon_atombios.c +++ b/drivers/gpu/drm/radeon/radeon_atombios.c @@ -1275,7 +1275,7 @@ bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index, switch (crev) { case 1: tv_info = (ATOM_ANALOG_TV_INFO *)(mode_info->atom_context->bios + data_offset); - if (index > MAX_SUPPORTED_TV_TIMING) + if (index >= MAX_SUPPORTED_TV_TIMING) return false; mode->crtc_htotal = le16_to_cpu(tv_info->aModeTimings[index].usCRTC_H_Total); @@ -1313,7 +1313,7 @@ bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index, break; case 2: tv_info_v1_2 = (ATOM_ANALOG_TV_INFO_V1_2 *)(mode_info->atom_context->bios + data_offset); - if (index > MAX_SUPPORTED_TV_TIMING_V1_2) + if (index >= MAX_SUPPORTED_TV_TIMING_V1_2) return false; dtd_timings = &tv_info_v1_2->aModeTimings[index];