diff options
| author | Alex Deucher <alexdeucher@gmail.com> | 2010-04-01 12:42:56 -0400 |
|---|---|---|
| committer | Alex Deucher <alexdeucher@gmail.com> | 2010-04-01 12:42:56 -0400 |
| commit | 476a1c6e8b42807b897b8c6f8550ec42b2d5c10e (patch) | |
| tree | fd9dba6bb487ac224e8dcfb7ee8d9d6d0a3190b8 /src | |
| parent | 6baa96c44ca93b88acf5233335cee233e59d5af4 (diff) | |
radeon: fix possible gpio i2c table overrun
GPIO_I2C_INFO does not always have ATOM_MAX_SUPPORTED_DEVICE
entries. Should fix Novell bug 589022.
Diffstat (limited to 'src')
| -rw-r--r-- | src/radeon_atombios.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/src/radeon_atombios.c b/src/radeon_atombios.c index bbe3d8e6..42b35d0b 100644 --- a/src/radeon_atombios.c +++ b/src/radeon_atombios.c @@ -1518,7 +1518,8 @@ RADEONLookupGPIOLineForDDC(ScrnInfoPtr pScrn, uint8_t id) ATOM_GPIO_I2C_ASSIGMENT *gpio; RADEONI2CBusRec i2c; uint8_t crev, frev; - int i; + unsigned short size; + int i, num_indices; memset(&i2c, 0, sizeof(RADEONI2CBusRec)); i2c.valid = FALSE; @@ -1527,12 +1528,15 @@ RADEONLookupGPIOLineForDDC(ScrnInfoPtr pScrn, uint8_t id) if (!rhdAtomGetTableRevisionAndSize( &(atomDataPtr->GPIO_I2C_Info->sHeader), - &crev,&frev,NULL)) { + &crev,&frev,&size)) { xf86DrvMsg(pScrn->scrnIndex, X_WARNING, "No GPIO Info Table found!\n"); return i2c; } - for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) { + num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) / + sizeof(ATOM_GPIO_I2C_ASSIGMENT); + + for (i = 0; i < num_indices; i++) { gpio = &atomDataPtr->GPIO_I2C_Info->asGPIO_Info[i]; if (gpio->sucI2cId.ucAccess == id) { i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4; |