Merge "misc: qfpfuse: validate ioctl input parameters"
diff --git a/drivers/misc/qfp_fuse.c b/drivers/misc/qfp_fuse.c
index 6505e61..f271f96 100644
--- a/drivers/misc/qfp_fuse.c
+++ b/drivers/misc/qfp_fuse.c
@@ -43,6 +43,7 @@
 #define QFP_FUSE_OFF                0x00
 
 #define QFP_FUSE_BUF_SIZE           64
+#define UINT32_MAX                  (0xFFFFFFFFU)
 
 
 struct qfp_priv_t {
@@ -59,8 +60,11 @@
 static inline bool is_usr_req_valid(const struct qfp_fuse_req *req)
 {
 	uint32_t size = qfp_priv->end - qfp_priv->base;
-	uint32_t req_size = req->size * sizeof(uint32_t);
+	uint32_t req_size;
 
+	if (req->size >= (UINT32_MAX / sizeof(uint32_t)))
+		return false;
+	req_size = req->size * sizeof(uint32_t);
 	if ((req_size == 0) || (req_size > size))
 		return false;
 	if (req->offset >= size)