Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp3734197imu; Mon, 7 Jan 2019 08:30:27 -0800 (PST) X-Google-Smtp-Source: ALg8bN4Prsnp4p/p2iNiETnckP0gztEVhMhNAzD6pRtdEMgZaZkuE0ZVMV3bKtf1OISd4ojUfJPM X-Received: by 2002:a17:902:12f:: with SMTP id 44mr62548501plb.74.1546878627741; Mon, 07 Jan 2019 08:30:27 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1546878627; cv=none; d=google.com; s=arc-20160816; b=BKiH9Puq083/1Y3yDzfPVx0+CUzdxuSZnCDMX+aOl3GBnnHME+ucsf+4Pxpu6wl8CQ IBHqclQKuPkz9w3rkdKULavHoauO/rwXdgcJ1TLW5OnFXYhM9DmlkpiqehIVUSFOI1Ay POxEtHfAzkObZCHi/UNc6EBTwDdBxE04hHJ4V1UI6/ut+AQw2RE1GL7Lt0Sv9jgIXoFQ RrDbPQC3BKVB0C6hlTzkYH/e+5MoBEMDXJycbd/eeoZv9EZPgWdsjvTlpDM2mf2d0++O 4sz0L12R0nRKpm4aFmISixpj+GgC/UJf9AxT6jCIScb0d5NVXblweQfXtXOZBJH2Qem8 IgDQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=DKCyHV51pNVHEKJ2iVzcbfOD8afyT5uZvglJoCgnwCg=; b=f3xlgRZEbP3GKCMaj0cahOSSVz8raIRVBW6rYmo6BV4atvb5g7m3Fo2AIFIA7Qyc3f bwBulp1IM4kNzRNO/MIN4PXkg4lebbckiJM4ODhppgrTWxYU5PRx78ygWscCwAdNah+l PjMvAIrMebQsXlP18B+C0BcxzXEW99flJFq4icAd7UDLYUdUrtDEfmONVziZiLZbtuMO 2KU4UnZ8tCI9v6L7KukcmLFGvg10Sb+HPmtOUE9g7lvXPf3ij1MKZxvkeAfhMOkmRHed U4EWYwzSyc8e9Gxn1lhUI+3n2WAMGlJkWZnOQlNbdrF9YxbnYKodZ9JzM5H+hpr+Ozmy qHzQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=fjCR8Dy6; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id r39si15551063pld.434.2019.01.07.08.30.12; Mon, 07 Jan 2019 08:30:27 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=fjCR8Dy6; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729603AbfAGNWz (ORCPT + 99 others); Mon, 7 Jan 2019 08:22:55 -0500 Received: from mail.kernel.org ([198.145.29.99]:59546 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727661AbfAGMna (ORCPT ); Mon, 7 Jan 2019 07:43:30 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D9FA720449; Mon, 7 Jan 2019 12:43:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1546865010; bh=FcOEr8xkYzEgbzUCKdvGvKX+0d3ZJgBYuKgvVRfms9U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fjCR8Dy62er7K/XlP91FClk043aDQyHFjrZRwURD6QBFGN69zp5vWIAg20fs4NEq8 fdM6Vpe1RWJ9iWiDJ1Rxw7hXolyvAQN+t536fLwkP3PiZMkpw8PVnW9BGdXRrW+ebC jm+/l+9XNcnoon9WIHIfyYY9+j+qy/R7Ll7Ao9wI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans Verkuil , syzbot+ccf0a61ed12f2a7313ee@syzkaller.appspotmail.com, Mauro Carvalho Chehab Subject: [PATCH 4.20 117/145] media: v4l2-tpg: array index could become negative Date: Mon, 7 Jan 2019 13:32:34 +0100 Message-Id: <20190107104452.539596382@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190107104437.308206189@linuxfoundation.org> References: <20190107104437.308206189@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.20-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hans Verkuil commit e5f71a27fa12c1a1b02ad478a568e76260f1815e upstream. text[s] is a signed char, so using that as index into the font8x16 array can result in negative indices. Cast it to u8 to be safe. Signed-off-by: Hans Verkuil Reported-by: syzbot+ccf0a61ed12f2a7313ee@syzkaller.appspotmail.com Cc: # for v4.7 and up Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c +++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c @@ -1769,7 +1769,7 @@ typedef struct { u16 __; u8 _; } __packe unsigned s; \ \ for (s = 0; s < len; s++) { \ - u8 chr = font8x16[text[s] * 16 + line]; \ + u8 chr = font8x16[(u8)text[s] * 16 + line]; \ \ if (hdiv == 2 && tpg->hflip) { \ pos[3] = (chr & (0x01 << 6) ? fg : bg); \