[PATCH] vesafb: Fix color palette handling

Fix out-of-bounds bug.  The pseudopalette has room only for 16 entries, thus,
write only the first 16 entries to the pseudopalette.
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

drivers/video/vesafb.c

@@ -166,10 +166,10 @@ static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green,
 	if (regno >= info->cmap.len)
 		return 1;
 
-	switch (info->var.bits_per_pixel) {
-	case 8:
+	if (info->var.bits_per_pixel == 8)
 		vesa_setpalette(regno,red,green,blue);
-		break;
+	else if (regno < 16) {
+		switch (info->var.bits_per_pixel) {
 		case 16:
 			if (info->var.red.offset == 10) {
 				/* 1:5:5:5 */
@@ -186,14 +186,6 @@ static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green,
 			}
 			break;
 		case 24:
-		red   >>= 8;
-		green >>= 8;
-		blue  >>= 8;
-		((u32 *)(info->pseudo_palette))[regno] =
-			(red   << info->var.red.offset)   |
-			(green << info->var.green.offset) |
-			(blue  << info->var.blue.offset);
-		break;
 		case 32:
 			red   >>= 8;
 			green >>= 8;
@@ -204,6 +196,8 @@ static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green,
 				(blue  << info->var.blue.offset);
 			break;
 		}
+	}
+
 	return 0;
 }