drm/nouveau: fix pramdac_table range checking
authorMarcin Slusarz <marcin.slusarz@gmail.com>
Wed, 17 Feb 2010 18:04:00 +0000 (19:04 +0100)
committerBen Skeggs <bskeggs@redhat.com>
Thu, 25 Feb 2010 05:09:07 +0000 (15:09 +1000)
get_tmds_index_reg reads some value from stack when mlv happens
to be equal to size of pramdac_table array. Fix it.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
drivers/gpu/drm/nouveau/nouveau_bios.c

index 0e9cd1d49130657c4aee725b8b490e75f0b4ba19..c1cee919b3cfacfbce378ff0d0bff04612f47178 100644 (file)
@@ -762,7 +762,7 @@ static uint32_t get_tmds_index_reg(struct drm_device *dev, uint8_t mlv)
                        dacoffset ^= 8;
                return 0x6808b0 + dacoffset;
        } else {
-               if (mlv > ARRAY_SIZE(pramdac_table)) {
+               if (mlv >= ARRAY_SIZE(pramdac_table)) {
                        NV_ERROR(dev, "Magic Lookup Value too big (%02X)\n",
                                                                        mlv);
                        return 0;