diff options
author | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2018-11-08 11:12:47 -0500 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-01-09 16:16:44 +0100 |
commit | b21535727613dfd00368fc37c4d14bd47e8b5543 (patch) | |
tree | 7f889966c40d1cea925d535e1261d10d7f7c2e47 | |
parent | c8d550daa0428a4240fba5eca1dfb49879000adc (diff) | |
download | linux-stable-b21535727613dfd00368fc37c4d14bd47e8b5543.tar.gz linux-stable-b21535727613dfd00368fc37c4d14bd47e8b5543.tar.bz2 linux-stable-b21535727613dfd00368fc37c4d14bd47e8b5543.zip |
media: v4l2-tpg: array index could become negative
commit e5f71a27fa12c1a1b02ad478a568e76260f1815e upstream.
text[s] is a signed char, so using that as index into the font8x16 array
can result in negative indices. Cast it to u8 to be safe.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+ccf0a61ed12f2a7313ee@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org> # for v4.7 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r-- | drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c index 1f463f4c3024..d2f72f3635aa 100644 --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c @@ -1618,7 +1618,7 @@ typedef struct { u16 __; u8 _; } __packed x24; unsigned s; \ \ for (s = 0; s < len; s++) { \ - u8 chr = font8x16[text[s] * 16 + line]; \ + u8 chr = font8x16[(u8)text[s] * 16 + line]; \ \ if (hdiv == 2 && tpg->hflip) { \ pos[3] = (chr & (0x01 << 6) ? fg : bg); \ |