video/console: Fix DM_VIDEO font glyph array indexing
When the character to be printed on a DM_VIDEO console is from the
"extended ASCII" range (0x80 - 0xff), it will be treated as a negative
number, as it's declared as a signed char. This leads to negative array
indicies into the glyph bitmap array, and random garbled characters.
Cast the character to an unsigned type to make the index always positive
and avoid an out-of-bounds access.
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
diff --git a/drivers/video/console_normal.c b/drivers/video/console_normal.c
index 2cfa510..7f01ee9 100644
--- a/drivers/video/console_normal.c
+++ b/drivers/video/console_normal.c
@@ -84,7 +84,8 @@
return -EAGAIN;
for (row = 0; row < VIDEO_FONT_HEIGHT; row++) {
- uchar bits = video_fontdata[ch * VIDEO_FONT_HEIGHT + row];
+ unsigned int idx = (u8)ch * VIDEO_FONT_HEIGHT + row;
+ uchar bits = video_fontdata[idx];
switch (vid_priv->bpix) {
#ifdef CONFIG_VIDEO_BPP8
diff --git a/drivers/video/console_rotate.c b/drivers/video/console_rotate.c
index f076570..71a5c5e 100644
--- a/drivers/video/console_rotate.c
+++ b/drivers/video/console_rotate.c
@@ -90,7 +90,7 @@
int i, col;
int mask = 0x80;
void *line;
- uchar *pfont = video_fontdata + ch * VIDEO_FONT_HEIGHT;
+ uchar *pfont = video_fontdata + (u8)ch * VIDEO_FONT_HEIGHT;
line = vid_priv->fb + (VID_TO_PIXEL(x_frac) + 1) *
vid_priv->line_length - (y + 1) * pbytes;
@@ -222,7 +222,8 @@
VIDEO_FONT_WIDTH - 1) * VNBYTES(vid_priv->bpix);
for (row = 0; row < VIDEO_FONT_HEIGHT; row++) {
- uchar bits = video_fontdata[ch * VIDEO_FONT_HEIGHT + row];
+ unsigned int idx = (u8)ch * VIDEO_FONT_HEIGHT + row;
+ uchar bits = video_fontdata[idx];
switch (vid_priv->bpix) {
#ifdef CONFIG_VIDEO_BPP8
@@ -348,7 +349,7 @@
void *line = vid_priv->fb +
(vid_priv->ysize - VID_TO_PIXEL(x_frac) - 1) *
vid_priv->line_length + y * pbytes;
- uchar *pfont = video_fontdata + ch * VIDEO_FONT_HEIGHT;
+ uchar *pfont = video_fontdata + (u8)ch * VIDEO_FONT_HEIGHT;
if (x_frac + VID_TO_POS(vc_priv->x_charsize) > vc_priv->xsize_frac)
return -EAGAIN;