aboutsummaryrefslogtreecommitdiff
path: root/drivers/video/aty/radeon_monitor.c
diff options
context:
space:
mode:
authorAntonino A. Daplas <adaplas@gmail.com>2006-03-11 03:27:28 -0800
committerLinus Torvalds <torvalds@g5.osdl.org>2006-03-11 09:19:36 -0800
commited62178589929d248a0aaf4018ca3867e2f96d9d (patch)
tree3dce07a9f0fa8bd6f5758174a1db80a090ea368b /drivers/video/aty/radeon_monitor.c
parent8e6509876c5cb079f56dbe334aafaae9a293c886 (diff)
[PATCH] radeonfb: Fix static array overrun
radeonfb_parse_monitor_layout() will produce an array overrun if passed with a substring of length higher than 4 (ie, "XXXXX,YYYYYY"). Coverity Bug 494 Signed-off-by: Antonino Daplas <adaplas@pol.net> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/video/aty/radeon_monitor.c')
-rw-r--r--drivers/video/aty/radeon_monitor.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/video/aty/radeon_monitor.c b/drivers/video/aty/radeon_monitor.c
index 7f9838dceab..98c05bc0de4 100644
--- a/drivers/video/aty/radeon_monitor.c
+++ b/drivers/video/aty/radeon_monitor.c
@@ -396,6 +396,10 @@ static int __devinit radeon_parse_monitor_layout(struct radeonfb_info *rinfo,
s1[i] = *s;
i++;
}
+
+ if (i > 4)
+ i = 4;
+
} while (*s++);
if (second)
s2[i] = 0;