video/console: Fix DM_VIDEO font glyph array indexing

When the character to be printed on a DM_VIDEO console is from the
"extended ASCII" range (0x80 - 0xff), it will be treated as a negative
number, as it's declared as a signed char. This leads to negative array
indicies into the glyph bitmap array, and random garbled characters.

Cast the character to an unsigned type to make the index always positive
and avoid an out-of-bounds access.

Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Simon Glass <sjg@chromium.org>

diff --git a/drivers/video/console_normal.c b/drivers/video/console_normal.c
index 2cfa510d5f7d7a0c2830986a21df1dc84d9eeab8..7f01ee94242049e48563c238ba438e580e8e5a93 100644 (file)
--- a/drivers/video/console_normal.c
+++ b/drivers/video/console_normal.c
@@ -84,7 +84,8 @@ static int console_normal_putc_xy(struct udevice *dev, uint x_frac, uint y,
                return -EAGAIN;
 
        for (row = 0; row < VIDEO_FONT_HEIGHT; row++) {
-               uchar bits = video_fontdata[ch * VIDEO_FONT_HEIGHT + row];
+               unsigned int idx = (u8)ch * VIDEO_FONT_HEIGHT + row;
+               uchar bits = video_fontdata[idx];
 
                switch (vid_priv->bpix) {
 #ifdef CONFIG_VIDEO_BPP8

diff --git a/drivers/video/console_rotate.c b/drivers/video/console_rotate.c
index f076570335b0f89d85ac755d04c93c47943916f5..71a5c5efba3c0011a772ac6bcf8a769a306d1267 100644 (file)
--- a/drivers/video/console_rotate.c
+++ b/drivers/video/console_rotate.c
@@ -90,7 +90,7 @@ static int console_putc_xy_1(struct udevice *dev, uint x_frac, uint y, char ch)
        int i, col;
        int mask = 0x80;
        void *line;
-       uchar *pfont = video_fontdata + ch * VIDEO_FONT_HEIGHT;
+       uchar *pfont = video_fontdata + (u8)ch * VIDEO_FONT_HEIGHT;
 
        line = vid_priv->fb + (VID_TO_PIXEL(x_frac) + 1) *
                        vid_priv->line_length - (y + 1) * pbytes;
@@ -222,7 +222,8 @@ static int console_putc_xy_2(struct udevice *dev, uint x_frac, uint y, char ch)
                        VIDEO_FONT_WIDTH - 1) * VNBYTES(vid_priv->bpix);
 
        for (row = 0; row < VIDEO_FONT_HEIGHT; row++) {
-               uchar bits = video_fontdata[ch * VIDEO_FONT_HEIGHT + row];
+               unsigned int idx = (u8)ch * VIDEO_FONT_HEIGHT + row;
+               uchar bits = video_fontdata[idx];
 
                switch (vid_priv->bpix) {
 #ifdef CONFIG_VIDEO_BPP8
@@ -348,7 +349,7 @@ static int console_putc_xy_3(struct udevice *dev, uint x_frac, uint y, char ch)
        void *line = vid_priv->fb +
                (vid_priv->ysize - VID_TO_PIXEL(x_frac) - 1) *
                vid_priv->line_length + y * pbytes;
-       uchar *pfont = video_fontdata + ch * VIDEO_FONT_HEIGHT;
+       uchar *pfont = video_fontdata + (u8)ch * VIDEO_FONT_HEIGHT;
 
        if (x_frac + VID_TO_POS(vc_priv->x_charsize) > vc_priv->xsize_frac)
                return -EAGAIN;