Package: sdl-image1.2 / 1.2.12-5+deb8u1

CVE-2017-12122-1.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
Description: lbm: use correct variable to check color planes.
Origin: upstream, https://hg.libsdl.org/SDL_image/rev/16772bbb1b09

--- a/IMG_lbm.c
+++ b/IMG_lbm.c
@@ -249,7 +249,7 @@ SDL_Surface *IMG_LoadLBM_RW( SDL_RWops *src )
 		goto done;
 	}
 
-	if ( ( Image = SDL_CreateRGBSurface( SDL_SWSURFACE, width, bmhd.h, (bmhd.planes==24 || flagHAM==1)?24:8, 0, 0, 0, 0 ) ) == NULL )
+	if ( ( Image = SDL_CreateRGBSurface( SDL_SWSURFACE, width, bmhd.h, (nbplanes==24 || flagHAM==1)?24:8, 0, 0, 0, 0 ) ) == NULL )
 	   goto done;
 
 	if ( bmhd.mask & 2 )               /* There is a transparent color */
@@ -276,7 +276,7 @@ SDL_Surface *IMG_LoadLBM_RW( SDL_RWops *src )
 		/* The 32 last colors are the same but divided by 2 */
 		/* Some Amiga pictures save 64 colors with 32 last wrong colors, */
 		/* they shouldn't !, and here we overwrite these 32 bad colors. */
-		if ( (nbcolors==32 || flagEHB ) && (1<<bmhd.planes)==64 )
+		if ( (nbcolors==32 || flagEHB ) && (1<<nbplanes)==64 )
 		{
 			nbcolors = 64;
 			ptr = &colormap[0];
@@ -290,8 +290,8 @@ SDL_Surface *IMG_LoadLBM_RW( SDL_RWops *src )
 
 		/* If nbcolors < 2^nbplanes, repeat the colormap */
 		/* This happens when pictures have a stencil mask */
-		if ( nbrcolorsfinal > (1<<bmhd.planes) ) {
-			nbrcolorsfinal = (1<<bmhd.planes);
+		if ( nbrcolorsfinal > (1<<nbplanes) ) {
+			nbrcolorsfinal = (1<<nbplanes);
 		}
 		for ( i=nbcolors; i < (Uint32)nbrcolorsfinal; i++ )
 		{