summaryrefslogtreecommitdiffstats
path: root/firmware/target/arm/s3c2440
diff options
context:
space:
mode:
authorThomas Jarosch <tomj@simonv.com>2014-12-20 14:47:09 +0100
committerThomas Jarosch <tomj@simonv.com>2014-12-20 14:47:09 +0100
commit575ec8902e61ea82bbe8639c1f5a29997b88dd8c (patch)
tree09f2932b0f2faaa1cb44acd5436d5ccdbd7fb903 /firmware/target/arm/s3c2440
parentd62e1b3c5ff513fb69e784cbfb59dad1cc67899b (diff)
downloadrockbox-575ec8902e61ea82bbe8639c1f5a29997b88dd8c.tar.gz
rockbox-575ec8902e61ea82bbe8639c1f5a29997b88dd8c.tar.bz2
rockbox-575ec8902e61ea82bbe8639c1f5a29997b88dd8c.zip
mini2440: Fix bogus buffer access in LCD backlight driver
The backlight driver always writes a bogus value from memory into the LCD brightness register. Fix it up by adding bounds checks and use a more sane default value. While looking at the code, I noticed that BACKLIGHT_CONTROL_SET probably ignores the desired brightness level, too. Note: Please test on real hardware, I don't own it. cppcheck reported: [rockbox/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c:53]: (error) Array 'log_brightness[13]' accessed at index 255, which is out of bounds. Change-Id: Iaafa929a8adaa97b93ebcb66e1f6bd3bf0dad84e
Diffstat (limited to 'firmware/target/arm/s3c2440')
-rw-r--r--firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c b/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c
index a9e003b80a..b39bfc4949 100644
--- a/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c
+++ b/firmware/target/arm/s3c2440/mini2440/backlight-mini2440.c
@@ -48,6 +48,11 @@ static unsigned char backlight_target;
/* Assumes that the backlight has been initialized */
void _backlight_set_brightness(int brightness)
{
+ if (brightness < 0)
+ brightness = 0;
+ else if(brightness > MAX_BRIGHTNESS_SETTING)
+ brightness = MAX_BRIGHTNESS_SETTING;
+
/* stop the interrupt from messing us up */
backlight_control = BACKLIGHT_CONTROL_IDLE;
_backlight_brightness = log_brightness[brightness];
@@ -85,11 +90,14 @@ static void led_control_service(void)
backlight_control = BACKLIGHT_CONTROL_IDLE;
break;
case BACKLIGHT_CONTROL_ON:
- _backlight_set_brightness(255);
+ _backlight_set_brightness(DEFAULT_BRIGHTNESS_SETTING);
backlight_control = BACKLIGHT_CONTROL_IDLE;
break;
case BACKLIGHT_CONTROL_SET:
- _backlight_set_brightness(255);
+ /* TODO: This is probably wrong since it sets a fixed value.
+ It was a fixed value of 255 before, but that was even more wrong
+ since it accessed the log_brightness buffer out of bounds */
+ _backlight_set_brightness(DEFAULT_BRIGHTNESS_SETTING);
backlight_control = BACKLIGHT_CONTROL_IDLE;
break;
case BACKLIGHT_CONTROL_FADE: