On Thu, 2010-04-22 at 11:40 +0200, Dan Carpenter wrote:
> If "gpio->line" is 32 then "nv50_gpio_reg[gpio->line >> 3]" reads past the
> end of the array.
Thanks, picked up in the nouveau tree.
>
> Signed-off-by: Dan Carpenter <erro...@gmail.com>
>
> diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c
> b/drivers/gpu/drm/nouveau/nv50_gpio.c
> index c61782b..bb47ad7 100644
> --- a/drivers/gpu/drm/nouveau/nv50_gpio.c
> +++ b/drivers/gpu/drm/nouveau/nv50_gpio.c
> @@ -31,7 +31,7 @@ nv50_gpio_location(struct dcb_gpio_entry *gpio, uint32_t
> *reg, uint32_t *shift)
> {
> const uint32_t nv50_gpio_reg[4] = { 0xe104, 0xe108, 0xe280, 0xe284 };
>
> - if (gpio->line > 32)
> + if (gpio->line >= 32)
> return -EINVAL;
>
> *reg = nv50_gpio_reg[gpio->line >> 3];
------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
--
_______________________________________________
Dri-devel mailing list
Dri-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dri-devel
