msm: mdp: Validate input arguments from user space

Fully verify the input arguments from user client are safe
to use.

Bug: 19136882
Change-Id: Ie14332443b187951009c63ebfb78456dcd9ba60f
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Signed-off-by: Patrick Tjin <pattjin@google.com>

drivers/video/msm/mdp.c

@@ -485,6 +485,11 @@ static int mdp_lut_hw_update(struct fb_cmap *cmap)
 	c[1] = cmap->blue;
 	c[2] = cmap->red;
 
+	if (cmap->start > MDP_HIST_LUT_SIZE || cmap->len > MDP_HIST_LUT_SIZE ||
+			(cmap->start + cmap->len > MDP_HIST_LUT_SIZE)) {
+		pr_err("mdp_lut_hw_update invalid arguments\n");
+		return -EINVAL;
+	}
 	for (i = 0; i < cmap->len; i++) {
 		if (copy_from_user(&r, cmap->red++, sizeof(r)) ||
 		    copy_from_user(&g, cmap->green++, sizeof(g)) ||