diff options
| author | Steve Pfetsch <spfetsch@google.com> | 2016-10-14 15:36:59 -0700 |
|---|---|---|
| committer | Pat Tjin <pattjin@google.com> | 2016-10-18 07:15:30 +0000 |
| commit | 46cdb14a7adc381533c860bd7847f42ef48b6b00 (patch) | |
| tree | 6b76343a48b0b22efdb4b7b1b9ac642f598ff89d | |
| parent | 814b50f0d7444946f7576515bcb871166eabf179 (diff) | |
| download | x86_64-46cdb14a7adc381533c860bd7847f42ef48b6b00.tar.gz | |
drivers: video: Add bounds checking in fb_cmap_to_user
Verify that unsigned int value will not become negative before cast to
signed int.
Bug: 31651010
Change-Id: I548a200f678762042617f11100b6966a405a3920
| -rw-r--r-- | drivers/video/fbcmap.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c index 5c3960da755a..5ac72814c8eb 100644 --- a/drivers/video/fbcmap.c +++ b/drivers/video/fbcmap.c @@ -190,6 +190,9 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) int tooff = 0, fromoff = 0; int size; + if ((int)(to->start) < 0) + return -EINVAL; + if (to->start > from->start) fromoff = to->start - from->start; else |