diff options
| author | Steve Pfetsch <spfetsch@google.com> | 2016-10-14 15:36:59 -0700 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 10:59:44 +0200 |
| commit | 4b9e26df11bcd4c4c132406f09f17111a0016d4a (patch) | |
| tree | 3c19ada6775a8be06d4dd07dea8b86f576b4af67 /drivers | |
| parent | 649cd86e99ffa107d481b8f7c4bb8219068f964a (diff) | |
drivers: video: Add bounds checking in fb_cmap_to_user
Verify that unsigned int value will not become negative before cast to
signed int.
Bug: 31651010
Change-Id: I548a200f678762042617f11100b6966a405a3920
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/fbcmap.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c index 5c3960da7..5ac72814c 100644 --- a/drivers/video/fbcmap.c +++ b/drivers/video/fbcmap.c @@ -190,6 +190,9 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) int tooff = 0, fromoff = 0; int size; + if ((int)(to->start) < 0) + return -EINVAL; + if (to->start > from->start) fromoff = to->start - from->start; else |