carminefb: fix possible access beyond end of carmine_modedb[]

[sfrench/cifs-2.6.git] / drivers / video / carminefb.c

diff --git a/drivers/video/carminefb.c b/drivers/video/carminefb.c
index c9b191319a9a6ca7cdd047d52fd5e38918db6176..0c02f8ec4bf3dafe14965025a3a1121e19ab4dfd 100644 (file)
--- a/drivers/video/carminefb.c
+++ b/drivers/video/carminefb.c
@@ -168,7 +168,7 @@ static int carmine_setcolreg(unsigned regno, unsigned red, unsigned green,
        blue >>= 8;
        transp >>= 8;
 
-       ((u32 *)info->pseudo_palette)[regno] = be32_to_cpu(transp << 24 |
+       ((__be32 *)info->pseudo_palette)[regno] = cpu_to_be32(transp << 24 |
                red << 0 | green << 8 | blue << 16);
        return 0;
 }
@@ -562,7 +562,7 @@ static int __devinit alloc_carmine_fb(void __iomem *regs, void __iomem *smem_bas
        if (ret < 0)
                goto err_free_fb;
 
-       if (fb_mode > ARRAY_SIZE(carmine_modedb))
+       if (fb_mode >= ARRAY_SIZE(carmine_modedb))
                fb_mode = CARMINEFB_DEFAULT_VIDEO_MODE;
 
        par->cur_mode = par->new_mode = ~0;