commit e73ad7625012d82f9f9f4dd9871ef85fab4d708c
author Linux Build Service Account <lnxbuild@localhost> Tue Mar 25 02:13:01 2014 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Mar 25 02:12:57 2014 -0700
tree ac5ff8ebe03397d005d05ea90bf6b996aa137a1a
parent 2cc01c4dd8cf980a011c7944053acc6da047ab96
parent e4ca8f47f93b6f3f84606dc5c003953c0694d5e7

Merge "misc: qfpfuse: validate ioctl input parameters"

drivers/misc/qfp_fuse.c

diff --git a/drivers/misc/qfp_fuse.c b/drivers/misc/qfp_fuse.c
index 6505e61..f271f96 100644
--- a/drivers/misc/qfp_fuse.c
+++ b/drivers/misc/qfp_fuse.c
@@ -43,6 +43,7 @@
 #define QFP_FUSE_OFF                0x00
 
 #define QFP_FUSE_BUF_SIZE           64
+#define UINT32_MAX                  (0xFFFFFFFFU)
 
 
 struct qfp_priv_t {
@@ -59,8 +60,11 @@
 static inline bool is_usr_req_valid(const struct qfp_fuse_req *req)
 {
 	uint32_t size = qfp_priv->end - qfp_priv->base;
-	uint32_t req_size = req->size * sizeof(uint32_t);
+	uint32_t req_size;
 
+	if (req->size >= (UINT32_MAX / sizeof(uint32_t)))
+		return false;
+	req_size = req->size * sizeof(uint32_t);
 	if ((req_size == 0) || (req_size > size))
 		return false;
 	if (req->offset >= size)