1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
From: "Ryan C. Gordon" <icculus@icculus.org>
Date: Wed, 24 Jan 2018 01:44:36 -0500
Subject: lbm: use correct variable to check color planes.
Bug: https://security-tracker.debian.org/tracker/CVE-2017-12122
Origin: upstream, 2.0.3, commit:16772bbb1b09, commit:https://github.com/libsdl-org/SDL_image/commit/571c0d7c62daeebeae30fb03f5712385bd3a95f0
---
IMG_lbm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/IMG_lbm.c b/IMG_lbm.c
index f475c60..9ff8374 100644
--- a/IMG_lbm.c
+++ b/IMG_lbm.c
@@ -249,7 +249,7 @@ SDL_Surface *IMG_LoadLBM_RW( SDL_RWops *src )
goto done;
}
- if ( ( Image = SDL_CreateRGBSurface( SDL_SWSURFACE, width, bmhd.h, (bmhd.planes==24 || flagHAM==1)?24:8, 0, 0, 0, 0 ) ) == NULL )
+ if ( ( Image = SDL_CreateRGBSurface( SDL_SWSURFACE, width, bmhd.h, (nbplanes==24 || flagHAM==1)?24:8, 0, 0, 0, 0 ) ) == NULL )
goto done;
if ( bmhd.mask & 2 ) /* There is a transparent color */
@@ -276,7 +276,7 @@ SDL_Surface *IMG_LoadLBM_RW( SDL_RWops *src )
/* The 32 last colors are the same but divided by 2 */
/* Some Amiga pictures save 64 colors with 32 last wrong colors, */
/* they shouldn't !, and here we overwrite these 32 bad colors. */
- if ( (nbcolors==32 || flagEHB ) && (1<<bmhd.planes)==64 )
+ if ( (nbcolors==32 || flagEHB ) && (1<<nbplanes)==64 )
{
nbcolors = 64;
ptr = &colormap[0];
@@ -290,8 +290,8 @@ SDL_Surface *IMG_LoadLBM_RW( SDL_RWops *src )
/* If nbcolors < 2^nbplanes, repeat the colormap */
/* This happens when pictures have a stencil mask */
- if ( nbrcolorsfinal > (1<<bmhd.planes) ) {
- nbrcolorsfinal = (1<<bmhd.planes);
+ if ( nbrcolorsfinal > (1<<nbplanes) ) {
+ nbrcolorsfinal = (1<<nbplanes);
}
for ( i=nbcolors; i < (Uint32)nbrcolorsfinal; i++ )
{
|
