diff options
author | Thomas Jarosch <tomj@simonv.com> | 2014-12-20 14:47:09 +0100 |
---|---|---|
committer | Thomas Jarosch <tomj@simonv.com> | 2014-12-20 14:47:09 +0100 |
commit | 575ec8902e61ea82bbe8639c1f5a29997b88dd8c (patch) | |
tree | 09f2932b0f2faaa1cb44acd5436d5ccdbd7fb903 | |
parent | d62e1b3c5ff513fb69e784cbfb59dad1cc67899b (diff) | |
download | rockbox-575ec8902e61ea82bbe8639c1f5a29997b88dd8c.tar.gz rockbox-575ec8902e61ea82bbe8639c1f5a29997b88dd8c.zip |
mini2440: Fix bogus buffer access in LCD backlight driver
The backlight driver always writes a bogus value
from memory into the LCD brightness register.
Fix it up by adding bounds checks and
use a more sane default value.
While looking at the code, I noticed
that BACKLIGHT_CONTROL_SET probably ignores
the desired brightness level, too.
Note: Please test on real hardware, I don't own it.
cppcheck reported:
[rockbox/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c:53]: (error) Array 'log_brightness[13]' accessed at index 255, which is out of bounds.
Change-Id: Iaafa929a8adaa97b93ebcb66e1f6bd3bf0dad84e
-rw-r--r-- | firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c b/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c index a9e003b80a..b39bfc4949 100644 --- a/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c +++ b/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c | |||
@@ -48,6 +48,11 @@ static unsigned char backlight_target; | |||
48 | /* Assumes that the backlight has been initialized */ | 48 | /* Assumes that the backlight has been initialized */ |
49 | void _backlight_set_brightness(int brightness) | 49 | void _backlight_set_brightness(int brightness) |
50 | { | 50 | { |
51 | if (brightness < 0) | ||
52 | brightness = 0; | ||
53 | else if(brightness > MAX_BRIGHTNESS_SETTING) | ||
54 | brightness = MAX_BRIGHTNESS_SETTING; | ||
55 | |||
51 | /* stop the interrupt from messing us up */ | 56 | /* stop the interrupt from messing us up */ |
52 | backlight_control = BACKLIGHT_CONTROL_IDLE; | 57 | backlight_control = BACKLIGHT_CONTROL_IDLE; |
53 | _backlight_brightness = log_brightness[brightness]; | 58 | _backlight_brightness = log_brightness[brightness]; |
@@ -85,11 +90,14 @@ static void led_control_service(void) | |||
85 | backlight_control = BACKLIGHT_CONTROL_IDLE; | 90 | backlight_control = BACKLIGHT_CONTROL_IDLE; |
86 | break; | 91 | break; |
87 | case BACKLIGHT_CONTROL_ON: | 92 | case BACKLIGHT_CONTROL_ON: |
88 | _backlight_set_brightness(255); | 93 | _backlight_set_brightness(DEFAULT_BRIGHTNESS_SETTING); |
89 | backlight_control = BACKLIGHT_CONTROL_IDLE; | 94 | backlight_control = BACKLIGHT_CONTROL_IDLE; |
90 | break; | 95 | break; |
91 | case BACKLIGHT_CONTROL_SET: | 96 | case BACKLIGHT_CONTROL_SET: |
92 | _backlight_set_brightness(255); | 97 | /* TODO: This is probably wrong since it sets a fixed value. |
98 | It was a fixed value of 255 before, but that was even more wrong | ||
99 | since it accessed the log_brightness buffer out of bounds */ | ||
100 | _backlight_set_brightness(DEFAULT_BRIGHTNESS_SETTING); | ||
93 | backlight_control = BACKLIGHT_CONTROL_IDLE; | 101 | backlight_control = BACKLIGHT_CONTROL_IDLE; |
94 | break; | 102 | break; |
95 | case BACKLIGHT_CONTROL_FADE: | 103 | case BACKLIGHT_CONTROL_FADE: |