]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
media: v4l2-tpg: array index could become negative
authorHans Verkuil <hverkuil-cisco@xs4all.nl>
Thu, 8 Nov 2018 16:12:47 +0000 (11:12 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Jan 2019 16:46:02 +0000 (17:46 +0100)
commitde1b2434a453b077139e5809f2761378698da735
treee94c9d731f3b3c74a860fe5d8ea53ae1a632f08a
parent314692da7ee9f7a0142182c7746ef60dd9797d5c
media: v4l2-tpg: array index could become negative

commit e5f71a27fa12c1a1b02ad478a568e76260f1815e upstream.

text[s] is a signed char, so using that as index into the font8x16 array
can result in negative indices. Cast it to u8 to be safe.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Reported-by: syzbot+ccf0a61ed12f2a7313ee@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org> # for v4.7 and up
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c