[PATCH] media: vivid: potential integer overflow in vidioc_g_edid()

[Dan Carpenter]

If we pick a very large "edid->blocks" value then the "edid->start_block
+ edid->blocks" addition could wrap around.

Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts")
Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com>

diff --git a/drivers/media/platform/vivid/vivid-vid-common.c 
b/drivers/media/platform/vivid/vivid-vid-common.c
index e5914be0e12d..be531caa2cdf 100644
--- a/drivers/media/platform/vivid/vivid-vid-common.c
+++ b/drivers/media/platform/vivid/vivid-vid-common.c
@@ -860,7 +860,7 @@ int vidioc_g_edid(struct file *file, void *_fh,
                return -ENODATA;
        if (edid->start_block >= dev->edid_blocks)
                return -EINVAL;
-       if (edid->start_block + edid->blocks > dev->edid_blocks)
+       if (edid->blocks > dev->edid_blocks - edid->start_block)
                edid->blocks = dev->edid_blocks - edid->start_block;
        if (adap)
                cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, 
adap->phys_addr);