From d39b8b9e21aedf584605e0948975ac0bc3a1aa8b Mon Sep 17 00:00:00 2001
From: Steve Pfetsch <spfetsch@google.com>
Date: Fri, 14 Oct 2016 15:36:59 -0700
Subject: [PATCH] drivers: video: Add bounds checking in fb_cmap_to_user

Verify that unsigned int value will not become negative before cast to
signed int.

Bug: 31651010
Change-Id: I548a200f678762042617f11100b6966a405a3920
---
 drivers/video/fbcmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
index 008212069ac6..520276154d7a 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbcmap.c
@@ -196,7 +196,7 @@ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
 	int tooff = 0, fromoff = 0;
 	int size;
 
-	if (!to || !from)
+	if (!to || !from || (int)(to->start) < 0)
 		return -EINVAL;
 
 	if (to->start > from->start)