1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
|
From 66950da7432b1743e60bebf5bd7fa6108c6585f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Mon, 18 Feb 2019 13:53:16 +0100
Subject: [PATCH] CVE-2019-7637: Fix in integer overflow in SDL_CalculatePitch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
If a too large width is passed to SDL_SetVideoMode() the width travels
to SDL_CalculatePitch() where the width (e.g. 65535) is multiplied by
BytesPerPixel (e.g. 4) and the result is stored into Uint16 pitch
variable. During this arithmetics an integer overflow can happen (e.g.
the value is clamped as 65532). As a result SDL_Surface with a pitch
smaller than width * BytesPerPixel is created, too small pixel buffer
is allocated and when the SDL_Surface is processed in SDL_FillRect()
a buffer overflow occurs.
This can be reproduced with "./graywin -width 21312312313123213213213"
command.
This patch fixes is by using a very careful arithmetics in
SDL_CalculatePitch(). If an overflow is detected, an error is reported
back as a special 0 value. We assume that 0-width surfaces do not
occur in the wild. Since SDL_CalculatePitch() is a private function,
we can change the semantics.
CVE-2019-7637
https://bugzilla.libsdl.org/show_bug.cgi?id=4497
Signed-off-by: Petr Písař <ppisar@redhat.com>
---
src/video/SDL_pixels.c | 41 +++++++++++++++++++++++++++------
src/video/gapi/SDL_gapivideo.c | 3 +++
src/video/nanox/SDL_nxvideo.c | 4 ++++
src/video/ps2gs/SDL_gsvideo.c | 3 +++
src/video/ps3/SDL_ps3video.c | 3 +++
src/video/windib/SDL_dibvideo.c | 3 +++
src/video/windx5/SDL_dx5video.c | 3 +++
src/video/x11/SDL_x11video.c | 4 ++++
8 files changed, 57 insertions(+), 7 deletions(-)
Index: libsdl1.2-1.2.15/src/video/SDL_pixels.c
===================================================================
--- libsdl1.2-1.2.15.orig/src/video/SDL_pixels.c
+++ libsdl1.2-1.2.15/src/video/SDL_pixels.c
@@ -286,26 +286,54 @@ void SDL_DitherColors(SDL_Color *colors,
}
}
/*
- * Calculate the pad-aligned scanline width of a surface
+ * Calculate the pad-aligned scanline width of a surface. Return 0 in case of
+ * an error.
*/
Uint16 SDL_CalculatePitch(SDL_Surface *surface)
{
- Uint16 pitch;
+ unsigned int pitch = 0;
/* Surface should be 4-byte aligned for speed */
- pitch = surface->w*surface->format->BytesPerPixel;
+ /* The code tries to prevent from an Uint16 overflow. */;
+ Uint8 byte;
+ for (byte = surface->format->BytesPerPixel; byte; byte--) {
+ pitch += (unsigned int)surface->w;
+ if (pitch < surface->w) {
+ SDL_SetError("A scanline is too wide");
+ return(0);
+ }
+ }
switch (surface->format->BitsPerPixel) {
case 1:
- pitch = (pitch+7)/8;
+ if (pitch % 8) {
+ pitch = pitch / 8 + 1;
+ } else {
+ pitch = pitch / 8;
+ }
break;
case 4:
- pitch = (pitch+1)/2;
+ if (pitch % 2) {
+ pitch = pitch / 2 + 1;
+ } else {
+ pitch = pitch / 2;
+ }
break;
default:
break;
}
- pitch = (pitch + 3) & ~3; /* 4-byte aligning */
- return(pitch);
+ /* 4-byte aligning */
+ if (pitch & 3) {
+ if (pitch + 3 < pitch) {
+ SDL_SetError("A scanline is too wide");
+ return(0);
+ }
+ pitch = (pitch + 3) & ~3;
+ }
+ if (pitch > 0xFFFF) {
+ SDL_SetError("A scanline is too wide");
+ return(0);
+ }
+ return((Uint16)pitch);
}
/*
* Match an RGB value to a particular palette index
Index: libsdl1.2-1.2.15/src/video/gapi/SDL_gapivideo.c
===================================================================
--- libsdl1.2-1.2.15.orig/src/video/gapi/SDL_gapivideo.c
+++ libsdl1.2-1.2.15/src/video/gapi/SDL_gapivideo.c
@@ -733,6 +733,9 @@ SDL_Surface *GAPI_SetVideoMode(_THIS, SD
video->w = gapi->w = width;
video->h = gapi->h = height;
video->pitch = SDL_CalculatePitch(video);
+ if (!current->pitch) {
+ return(NULL);
+ }
/* Small fix for WinCE/Win32 - when activating window
SDL_VideoSurface is equal to zero, so activating code
Index: libsdl1.2-1.2.15/src/video/nanox/SDL_nxvideo.c
===================================================================
--- libsdl1.2-1.2.15.orig/src/video/nanox/SDL_nxvideo.c
+++ libsdl1.2-1.2.15/src/video/nanox/SDL_nxvideo.c
@@ -378,6 +378,10 @@ SDL_Surface * NX_SetVideoMode (_THIS, SD
current -> w = width ;
current -> h = height ;
current -> pitch = SDL_CalculatePitch (current) ;
+ if (!current->pitch) {
+ current = NULL;
+ goto done;
+ }
NX_ResizeImage (this, current, flags) ;
}
Index: libsdl1.2-1.2.15/src/video/ps2gs/SDL_gsvideo.c
===================================================================
--- libsdl1.2-1.2.15.orig/src/video/ps2gs/SDL_gsvideo.c
+++ libsdl1.2-1.2.15/src/video/ps2gs/SDL_gsvideo.c
@@ -479,6 +479,9 @@ static SDL_Surface *GS_SetVideoMode(_THI
current->w = width;
current->h = height;
current->pitch = SDL_CalculatePitch(current);
+ if (!current->pitch) {
+ return(NULL);
+ }
/* Memory map the DMA area for block memory transfer */
if ( ! mapped_mem ) {
Index: libsdl1.2-1.2.15/src/video/ps3/SDL_ps3video.c
===================================================================
--- libsdl1.2-1.2.15.orig/src/video/ps3/SDL_ps3video.c
+++ libsdl1.2-1.2.15/src/video/ps3/SDL_ps3video.c
@@ -339,6 +339,9 @@ static SDL_Surface *PS3_SetVideoMode(_TH
current->w = width;
current->h = height;
current->pitch = SDL_CalculatePitch(current);
+ if (!current->pitch) {
+ return(NULL);
+ }
/* Alloc aligned mem for current->pixels */
s_pixels = memalign(16, current->h * current->pitch);
Index: libsdl1.2-1.2.15/src/video/windib/SDL_dibvideo.c
===================================================================
--- libsdl1.2-1.2.15.orig/src/video/windib/SDL_dibvideo.c
+++ libsdl1.2-1.2.15/src/video/windib/SDL_dibvideo.c
@@ -675,6 +675,9 @@ SDL_Surface *DIB_SetVideoMode(_THIS, SDL
video->w = width;
video->h = height;
video->pitch = SDL_CalculatePitch(video);
+ if (!current->pitch) {
+ return(NULL);
+ }
/* Small fix for WinCE/Win32 - when activating window
SDL_VideoSurface is equal to zero, so activating code
Index: libsdl1.2-1.2.15/src/video/windx5/SDL_dx5video.c
===================================================================
--- libsdl1.2-1.2.15.orig/src/video/windx5/SDL_dx5video.c
+++ libsdl1.2-1.2.15/src/video/windx5/SDL_dx5video.c
@@ -1127,6 +1127,9 @@ SDL_Surface *DX5_SetVideoMode(_THIS, SDL
video->w = width;
video->h = height;
video->pitch = SDL_CalculatePitch(video);
+ if (!current->pitch) {
+ return(NULL);
+ }
#ifndef NO_CHANGEDISPLAYSETTINGS
/* Set fullscreen mode if appropriate.
Index: libsdl1.2-1.2.15/src/video/x11/SDL_x11video.c
===================================================================
--- libsdl1.2-1.2.15.orig/src/video/x11/SDL_x11video.c
+++ libsdl1.2-1.2.15/src/video/x11/SDL_x11video.c
@@ -1216,6 +1216,10 @@ SDL_Surface *X11_SetVideoMode(_THIS, SDL
current->w = width;
current->h = height;
current->pitch = SDL_CalculatePitch(current);
+ if (!current->pitch) {
+ current = NULL;
+ goto done;
+ }
if (X11_ResizeImage(this, current, flags) < 0) {
current = NULL;
goto done;
|
