summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlex Deucher <alexdeucher@gmail.com>2010-04-01 12:42:56 -0400
committerAlex Deucher <alexdeucher@gmail.com>2010-04-01 12:42:56 -0400
commit476a1c6e8b42807b897b8c6f8550ec42b2d5c10e (patch)
treefd9dba6bb487ac224e8dcfb7ee8d9d6d0a3190b8
parent6baa96c44ca93b88acf5233335cee233e59d5af4 (diff)
radeon: fix possible gpio i2c table overrun
GPIO_I2C_INFO does not always have ATOM_MAX_SUPPORTED_DEVICE entries. Should fix Novell bug 589022.
-rw-r--r--src/radeon_atombios.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/src/radeon_atombios.c b/src/radeon_atombios.c
index bbe3d8e6..42b35d0b 100644
--- a/src/radeon_atombios.c
+++ b/src/radeon_atombios.c
@@ -1518,7 +1518,8 @@ RADEONLookupGPIOLineForDDC(ScrnInfoPtr pScrn, uint8_t id)
ATOM_GPIO_I2C_ASSIGMENT *gpio;
RADEONI2CBusRec i2c;
uint8_t crev, frev;
- int i;
+ unsigned short size;
+ int i, num_indices;
memset(&i2c, 0, sizeof(RADEONI2CBusRec));
i2c.valid = FALSE;
@@ -1527,12 +1528,15 @@ RADEONLookupGPIOLineForDDC(ScrnInfoPtr pScrn, uint8_t id)
if (!rhdAtomGetTableRevisionAndSize(
&(atomDataPtr->GPIO_I2C_Info->sHeader),
- &crev,&frev,NULL)) {
+ &crev,&frev,&size)) {
xf86DrvMsg(pScrn->scrnIndex, X_WARNING, "No GPIO Info Table found!\n");
return i2c;
}
- for (i = 0; i < ATOM_MAX_SUPPORTED_DEVICE; i++) {
+ num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
+ sizeof(ATOM_GPIO_I2C_ASSIGMENT);
+
+ for (i = 0; i < num_indices; i++) {
gpio = &atomDataPtr->GPIO_I2C_Info->asGPIO_Info[i];
if (gpio->sucI2cId.ucAccess == id) {
i2c.mask_clk_reg = le16_to_cpu(gpio->usClkMaskRegisterIndex) * 4;