From dda53dd9966fb1cd781f6aa12d866d777da0a5df Mon Sep 17 00:00:00 2001 From: Steve Pfetsch Date: Fri, 14 Oct 2016 15:36:59 -0700 Subject: drivers: video: Add bounds checking in fb_cmap_to_user Verify that unsigned int value will not become negative before cast to signed int. Bug: 31651010 Change-Id: I548a200f678762042617f11100b6966a405a3920 --- drivers/video/fbcmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c index f67cdcd..b1d63b5 100644 --- a/drivers/video/fbcmap.c +++ b/drivers/video/fbcmap.c @@ -196,7 +196,7 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) int tooff = 0, fromoff = 0; int size; - if (!to || !from) + if (!to || !from || (int)(to->start) < 0) return -EINVAL; if (to->start > from->start) -- cgit v1.1