media: v4l2-tpg: array index could become negative
authorHans Verkuil <hverkuil-cisco@xs4all.nl>
Thu, 8 Nov 2018 16:12:47 +0000 (11:12 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Jan 2019 16:14:51 +0000 (17:14 +0100)
commit35323cb2ae4e6a83bcb961e3744a9278806854e5
tree2d71c5c5e307c296ccdf2e7ce743e0d241bb6a22
parentcd1f0770d2772ebfab5678725a55b479465558a0
media: v4l2-tpg: array index could become negative

commit e5f71a27fa12c1a1b02ad478a568e76260f1815e upstream.

text[s] is a signed char, so using that as index into the font8x16 array
can result in negative indices. Cast it to u8 to be safe.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+ccf0a61ed12f2a7313ee@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org> # for v4.7 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c