neofb: Fix pseudo_palette array overrun in neofb_setcolreg

The pseudo_palette has room for 16 entries only, but in truecolor mode, it
attempts to write 256.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Acked-by: Tero Roponen <teanropo@jyu.fi>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

drivers/video/neofb.c

@@ -1286,14 +1286,14 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
 	if (regno >= fb->cmap.len || regno > 255)
 		return -EINVAL;
 
-	switch (fb->var.bits_per_pixel) {
-	case 8:
+	if (fb->var.bits_per_pixel <= 8) {
 		outb(regno, 0x3c8);
 
 		outb(red >> 10, 0x3c9);
 		outb(green >> 10, 0x3c9);
 		outb(blue >> 10, 0x3c9);
-		break;
+	} else if (regno < 16) {
+		switch (fb->var.bits_per_pixel) {
 		case 16:
 			((u32 *) fb->pseudo_palette)[regno] =
 				((red & 0xf800)) | ((green & 0xfc00) >> 5) |
@@ -1314,6 +1314,8 @@ static int neofb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
 		default:
 			return 1;
 		}
+	}
+
 	return 0;
 }