aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSteve Pfetsch <spfetsch@google.com>2016-10-14 15:36:59 -0700
committerSimon Shields <keepcalm444@gmail.com>2016-12-13 00:14:54 +1100
commitdda53dd9966fb1cd781f6aa12d866d777da0a5df (patch)
treebcd3fe7cb52236fbd442b1ee78ad66564e86e6bc
parentf78455200fe1885ee2a9b1a1ae7176a51ff77aa9 (diff)
downloadkernel_samsung_smdk4412-dda53dd9966fb1cd781f6aa12d866d777da0a5df.zip
kernel_samsung_smdk4412-dda53dd9966fb1cd781f6aa12d866d777da0a5df.tar.gz
kernel_samsung_smdk4412-dda53dd9966fb1cd781f6aa12d866d777da0a5df.tar.bz2
drivers: video: Add bounds checking in fb_cmap_to_user
Verify that unsigned int value will not become negative before cast to signed int. Bug: 31651010 Change-Id: I548a200f678762042617f11100b6966a405a3920
-rw-r--r--drivers/video/fbcmap.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
index f67cdcd..b1d63b5 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbcmap.c
@@ -196,7 +196,7 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
int tooff = 0, fromoff = 0;
int size;
- if (!to || !from)
+ if (!to || !from || (int)(to->start) < 0)
return -EINVAL;
if (to->start > from->start)