[PATCH] pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write

[Hyunwoo Kim <imv4bel@gmail.com>]

In pxa3xx_gcu_write, a count parameter of
type size_t is passed to words of type int.
Then, copy_from_user may cause a heap overflow because
it is used as the third argument of copy_from_user.

Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
 drivers/video/fbdev/pxa3xx-gcu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c
index 043cc8f9ef1c..5ca6d37e365f 100644
--- a/drivers/video/fbdev/pxa3xx-gcu.c
+++ b/drivers/video/fbdev/pxa3xx-gcu.c
@@ -389,7 +389,7 @@ pxa3xx_gcu_write(struct file *file, const char *buff,
 	priv->shared->num_words += words;
 
 	/* Last word reserved for batch buffer end command */
-	if (words >= PXA3XX_GCU_BATCH_WORDS)
+	if (words >= PXA3XX_GCU_BATCH_WORDS || words < 0)
 		return -E2BIG;
 
 	/* Wait for a free buffer */
-- 
2.25.1