1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
From: =?utf-8?b?UGV0ciBQw61zYcWZ?= <ppisar@redhat.com>
Date: Mon, 18 Feb 2019 07:48:23 -0800
Subject: CVE-2019-7638,
CVE-2019-7636: Refuse loading BMP images with too high number of colors
If a BMP file that defines more colors than can fit into
a palette of color depth defined in the same BMP file is loaded by
SDL_LoadBMP_RW() function, invalid number of colors is set into
resulting SDL surface.
Then if the SDL surface is passed to SDL_DisplayFormat() function to
convert the surface format into a native video format, a buffer
overread will happen in Map1to1() or Map1toN() function
(CVE-2019-7638). (The choice of the mapping function depends on
a actual video hardware.)
In addition SDL_GetRGB() called indirectly from SDL_DisplayFormat()
performs the same buffer overread (CVE-2019-7636).
There is also probably a buffer overwrite when the SDL_LoadBMP_RW()
loads colors from a file.
This patch fixes it by refusing loading such badly damaged BMP files.
Forwarded: https://bugzilla-attachments.libsdl.org/attachments/3631/0001-CVE-2019-7638-CVE-2019-7636-Refuse-loading-BMP-image.patch.txt
Origin: upstream, commit:https://hg.libsdl.org/SDL/rev/19d8c3b9c251
Origin: upstream, commit:https://github.com/libsdl-org/SDL-1.2/commit/3c6f20586bb4ba074c73bb3e06d7123e57d4a226
Bug: https://github.com/libsdl-org/SDL-1.2/issues/787
Bug: https://bugzilla.libsdl.org/show_bug.cgi?id=4499
Bug: https://bugzilla.libsdl.org/show_bug.cgi?id=4500
Bug-CVE: CVE-2019-7636
Bug-CVE: CVE-2019-7638
---
src/video/SDL_bmp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c
index d56cfd8..3accded 100644
--- a/src/video/SDL_bmp.c
+++ b/src/video/SDL_bmp.c
@@ -233,6 +233,10 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops *src, int freesrc)
if ( palette ) {
if ( biClrUsed == 0 ) {
biClrUsed = 1 << biBitCount;
+ } else if ( biClrUsed > (1 << biBitCount) ) {
+ SDL_SetError("BMP file has an invalid number of colors");
+ was_error = SDL_TRUE;
+ goto done;
}
if ( biSize == 12 ) {
for ( i = 0; i < (int)biClrUsed; ++i ) {
|
