[PATCH] intelfb: Fix buffer overrun

The pseudo_palette has room only for 16 entries, but intelfb_setcolreg will
attempt to write more.

Coverity Bug 558
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

drivers/video/intelfb/intelfbdrv.c

@@ -1333,9 +1333,7 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
 	if (regno > 255)
 		return 1;
 
-	switch (dinfo->depth) {
-	case 8:
-		{
+	if (dinfo->depth == 8) {
 		red >>= 8;
 		green >>= 8;
 		blue >>= 8;
@@ -1343,7 +1341,9 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
 		intelfbhw_setcolreg(dinfo, regno, red, green, blue,
 				    transp);
 	}
-		break;
+
+	if (regno < 16) {
+		switch (dinfo->depth) {
 		case 15:
 			dinfo->pseudo_palette[regno] = ((red & 0xf800) >>  1) |
 				((green & 0xf800) >>  6) |
@@ -1360,6 +1360,8 @@ intelfb_setcolreg(unsigned regno, unsigned red, unsigned green,
 				((blue  & 0xff00) >> 8);
 			break;
 		}
+	}
+
 	return 0;
 }