| From e5f71a27fa12c1a1b02ad478a568e76260f1815e Mon Sep 17 00:00:00 2001 |
| From: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Date: Thu, 8 Nov 2018 11:12:47 -0500 |
| Subject: media: v4l2-tpg: array index could become negative |
| |
| From: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| |
| commit e5f71a27fa12c1a1b02ad478a568e76260f1815e upstream. |
| |
| text[s] is a signed char, so using that as index into the font8x16 array |
| can result in negative indices. Cast it to u8 to be safe. |
| |
| Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> |
| Reported-by: syzbot+ccf0a61ed12f2a7313ee@syzkaller.appspotmail.com |
| Cc: <stable@vger.kernel.org> # for v4.7 and up |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c |
| +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c |
| @@ -1618,7 +1618,7 @@ typedef struct { u16 __; u8 _; } __packe |
| unsigned s; \ |
| \ |
| for (s = 0; s < len; s++) { \ |
| - u8 chr = font8x16[text[s] * 16 + line]; \ |
| + u8 chr = font8x16[(u8)text[s] * 16 + line]; \ |
| \ |
| if (hdiv == 2 && tpg->hflip) { \ |
| pos[3] = (chr & (0x01 << 6) ? fg : bg); \ |
