drm/radeon: fix a couple of array index errors

There are a couple of array overruns, and some associated confusion in
the code.
This is just a wild guess at what the code should actually look like.

Coverity CID: 13305 13306

agd5f: fix up the original intent of the timing code

Signed-off-by: Darren Jenkins <darrenrjenkins@gmail.com>
Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

diff --git a/drivers/gpu/drm/radeon/radeon_legacy_tv.c b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
index 3a12bb0c0563daa412aa07ea61bf6ab0368fc4d5..417684daef4cb4009057caffb128b6c7533e85c6 100644 (file)
--- a/drivers/gpu/drm/radeon/radeon_legacy_tv.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
@@ -77,7 +77,7 @@ struct radeon_tv_mode_constants {
        unsigned pix_to_tv;
 };
 
-static const uint16_t hor_timing_NTSC[] = {
+static const uint16_t hor_timing_NTSC[MAX_H_CODE_TIMING_LEN] = {
        0x0007,
        0x003f,
        0x0263,
@@ -98,7 +98,7 @@ static const uint16_t hor_timing_NTSC[] = {
        0
 };
 
-static const uint16_t vert_timing_NTSC[] = {
+static const uint16_t vert_timing_NTSC[MAX_V_CODE_TIMING_LEN] = {
        0x2001,
        0x200d,
        0x1006,
@@ -115,7 +115,7 @@ static const uint16_t vert_timing_NTSC[] = {
        0
 };
 
-static const uint16_t hor_timing_PAL[] = {
+static const uint16_t hor_timing_PAL[MAX_H_CODE_TIMING_LEN] = {
        0x0007,
        0x0058,
        0x027c,
@@ -136,7 +136,7 @@ static const uint16_t hor_timing_PAL[] = {
        0
 };
 
-static const uint16_t vert_timing_PAL[] =      {
+static const uint16_t vert_timing_PAL[MAX_V_CODE_TIMING_LEN] = {
        0x2001,
        0x200c,
        0x1005,
@@ -623,9 +623,9 @@ void radeon_legacy_tv_mode_set(struct drm_encoder *encoder,
        }
        flicker_removal = (tmp + 500) / 1000;
 
-       if (flicker_removal < 3)
-               flicker_removal = 3;
-       for (i = 0; i < 6; ++i) {
+       if (flicker_removal < 2)
+               flicker_removal = 2;
+       for (i = 0; i < ARRAY_SIZE(SLOPE_limit); ++i) {
                if (flicker_removal == SLOPE_limit[i])
                        break;
        }