media: v4l2-tpg: array index could become negative

BugLink: https://bugs.launchpad.net/bugs/1837257
commit e5f71a27fa12c1a1b02ad478a568e76260f1815e upstream.

text[s] is a signed char, so using that as index into the font8x16 array
can result in negative indices. Cast it to u8 to be safe.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+ccf0a61ed12f2a7313ee@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>      # for v4.7 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
index 7627b6dece0c5c6c5b231bbc8515c4cb73872bb2..807fd72912de0b87bb38b8aa7300b1bc36c52c5a 100644 (file)
--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
@@ -1745,7 +1745,7 @@ typedef struct { u16 __; u8 _; } __packed x24;
                unsigned s;     \
        \
                for (s = 0; s < len; s++) {     \
-                       u8 chr = font8x16[text[s] * 16 + line]; \
+                       u8 chr = font8x16[(u8)text[s] * 16 + line];     \
        \
                        if (hdiv == 2 && tpg->hflip) { \
                                pos[3] = (chr & (0x01 << 6) ? fg : bg); \