[PATCH] xfree86/edid: stay in array bounds in DDCModesFromEstIII()

[Tobias Droste]

Signed-off-by: Tobias Droste <tdroste at gmx.de>
---
 hw/xfree86/modes/xf86EdidModes.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/xfree86/modes/xf86EdidModes.c b/hw/xfree86/modes/xf86EdidModes.c
index 86065f8..3a5d583 100644
--- a/hw/xfree86/modes/xf86EdidModes.c
+++ b/hw/xfree86/modes/xf86EdidModes.c
@@ -737,12 +737,13 @@ static DisplayModePtr
 DDCModesFromEstIII(unsigned char *est)
 {
     DisplayModePtr modes = NULL;
-    int i, j, m;
+    int i, j, m, max_j;
 
     for (i = 0; i < 6; i++) {
-	for (j = 7; j > 0; j--) {
+	max_j = i == 5 ? 3 : 7;
+	for (j = max_j; j > 0; j--) {
 	    if (est[i] & (1 << j)) {
-		m = (i * 8) + (7 - j);
+		m = (i * 8) + (max_j - j);
 		modes = xf86ModesAdd(modes,
 				     FindDMTMode(EstIIIModes[m].w,
 						 EstIIIModes[m].h,
-- 
1.7.3.4