media: v4l2-tpg: array index could become negative
authorHans Verkuil <hverkuil-cisco@xs4all.nl>
Thu, 8 Nov 2018 16:12:47 +0000 (11:12 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Jan 2019 16:38:47 +0000 (17:38 +0100)
commit47af3cecd561eaea1084d3768759c14fb8be43eb
treebed4a0aa5724cdd1c31362d29020ee8e4819a842
parent245fc1c7f688c8e6e5fe7076973a414755d18cf0
media: v4l2-tpg: array index could become negative

commit e5f71a27fa12c1a1b02ad478a568e76260f1815e upstream.

text[s] is a signed char, so using that as index into the font8x16 array
can result in negative indices. Cast it to u8 to be safe.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+ccf0a61ed12f2a7313ee@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org> # for v4.7 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c