diff options
| author | Alex Deucher <alexdeucher@gmail.com> | 2010-04-01 12:42:56 -0400 |
|---|---|---|
| committer | Alex Deucher <alexdeucher@gmail.com> | 2010-04-01 12:44:51 -0400 |
| commit | 2ba50082c9de651e9d2def4230ef87ac89feb431 (patch) | |
| tree | 76c5f324ae13adc212881c080bf7e760c5045036 /src | |
| parent | 94202762f97d0cc8f2d0109e4f424f70a5460120 (diff) | |
radeon: fix possible gpio i2c table overrun
GPIO_I2C_INFO does not always have ATOM_MAX_SUPPORTED_DEVICE
entries. Should fix Novell bug 589022.
Diffstat (limited to 'src')
| -rw-r--r-- | src/radeon_atombios.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/src/radeon_atombios.c b/src/radeon_atombios.c index 0ceef785..7108da70 100644 --- a/src/radeon_atombios.c +++ b/src/radeon_atombios.c @@ -1451,7 +1451,8 @@ RADEONLookupGPIOLineForDDC(ScrnInfoPtr pScrn, uint8_t id) ATOM_GPIO_I2C_ASSIGMENT *gpio; RADEONI2CBusRec i2c; uint8_t crev, frev; - int i; + unsigned short size; + int i, num_indices; memset(&i2c, 0, sizeof(RADEONI2CBusRec)); i2c.valid = FALSE; @@ -1460,12 +1461,15 @@ RADEONLookupGPIOLineForDDC(ScrnInfoPtr pScrn, uint8_t id) if (!rhdAtomGetTableRevisionAndSize( &(atomDataPtr->GPIO_I2C_Info->sHeader), - &crev,&frev,NULL)) { + &crev,&frev,&size)) { xf86DrvMsg(pScrn->scrnIndex, X_WARNING, "No GPIO Info Table found!\n"); return i2c; } - for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) { + num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) / + sizeof(ATOM_GPIO_I2C_ASSIGMENT); + + for (i = 0; i < num_indices; i++) { gpio = &atomDataPtr->GPIO_I2C_Info->asGPIO_Info[i]; if (gpio->sucI2cId.ucAccess == id) { i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4; |