macfb: fix pseudo_palette size and overrun

- the pseudo_palette is only 16 elements long.
- do not write to the pseudo_palette if regno (array index) is more than 15.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

drivers/video/macfb.c

@@ -170,7 +170,7 @@ static struct fb_fix_screeninfo macfb_fix = {
 };
 
 static struct fb_info fb_info;
-static u32 pseudo_palette[17];
+static u32 pseudo_palette[16];
 static int inverse   = 0;
 static int vidtest   = 0;
 
@@ -529,6 +529,7 @@ static int macfb_setcolreg(unsigned regno, unsigned red, unsigned green,
 	if (regno >= fb_info->cmap.len)
 		return 1;
 
+	if (fb_info->var.bits_per_pixel <= 8) {
 		switch (fb_info->var.bits_per_pixel) {
 		case 1:
 			/* We shouldn't get here */
@@ -537,10 +538,14 @@ static int macfb_setcolreg(unsigned regno, unsigned red, unsigned green,
 		case 4:
 		case 8:
 			if (macfb_setpalette)
-			macfb_setpalette(regno, red, green, blue, fb_info);
+				macfb_setpalette(regno, red, green, blue,
+						 fb_info);
 			else
 				return 1;
 			break;
+		}
+	} else if (regno < 16) {
+		switch (fb_info->var.bits_per_pixel) {
 		case 16:
 			if (fb_info->var.red.offset == 10) {
 				/* 1:5:5:5 */
@@ -578,6 +583,8 @@ static int macfb_setcolreg(unsigned regno, unsigned red, unsigned green,
 				(blue  << fb_info->var.blue.offset);
 			break;
 		}
+	}
+
 	return 0;
 }