On Sat, Sep 23, 2006 at 06:21:35PM +0100, Al Viro wrote:
> Signed-off-by: Al Viro <[email protected]>
> ---
> drivers/video/riva/fbdev.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
> index 61a4665..4acde4f 100644
> --- a/drivers/video/riva/fbdev.c
> +++ b/drivers/video/riva/fbdev.c
> @@ -1826,7 +1826,7 @@ static int __devinit riva_get_EDID_OF(st
> {
> struct riva_par *par = info->par;
> struct device_node *dp;
> - unsigned char *pedid = NULL;
> + const unsigned char *pedid = NULL;
Ho-hum... Actually, that looks like a genuine bug. Look:
rivafb_probe():
riva_get_EDID(info, pd);
riva_get_edidinfo(info);
riva_get_EDID() -> riva_get_EDID_OF() ->
pedid = get_property(dp, propnames[i], NULL);
if (pedid != NULL) {
par->EDID = pedid;
NVTRACE("LCD found.\n");
return 1;
}
then in
riva_get_edidinfo():
struct riva_par *par = info->par;
fb_edid_to_monspecs(par->EDID, &info->monspecs);
fb_edid_to_monspecs() -> edid_checksum() -> fix_edid() -> modifies the string.
What's worse, fb_edid_to_monspecs() appears to assume that the string it
got is long enough. So... what the hell is going on there? I'd probably
did kmalloc() and copy that sucker there, making sure that it _is_ long
enough for fbmon.c while we are at it. Other suggestions?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
