media: v4l2-tpg: array index could become negative
authorHans Verkuil <hverkuil-cisco@xs4all.nl>
Thu, 8 Nov 2018 16:12:47 +0000 (11:12 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Jan 2019 15:16:44 +0000 (16:16 +0100)
commitb21535727613dfd00368fc37c4d14bd47e8b5543
tree7f889966c40d1cea925d535e1261d10d7f7c2e47
parentc8d550daa0428a4240fba5eca1dfb49879000adc
media: v4l2-tpg: array index could become negative

commit e5f71a27fa12c1a1b02ad478a568e76260f1815e upstream.

text[s] is a signed char, so using that as index into the font8x16 array
can result in negative indices. Cast it to u8 to be safe.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+ccf0a61ed12f2a7313ee@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org> # for v4.7 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c