|
 |
8d9706 |
From 762c1eb5a1a0e72a8120cfee5699820a73e82152 Mon Sep 17 00:00:00 2001
|
|
|
8d9706 |
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
|
|
8d9706 |
Date: Fri, 15 Feb 2019 16:52:27 +0100
|
|
|
8d9706 |
Subject: [PATCH 10/11] CVE-2019-7638, CVE-2019-7636: Refuse loading BMP images
|
|
|
8d9706 |
with too high number of colors
|
|
|
8d9706 |
MIME-Version: 1.0
|
|
|
8d9706 |
Content-Type: text/plain; charset=UTF-8
|
|
|
8d9706 |
Content-Transfer-Encoding: 8bit
|
|
|
8d9706 |
|
|
|
8d9706 |
If a BMP file that defines more colors than can fit into
|
|
|
8d9706 |
a palette of color depth defined in the same BMP file is loaded by
|
|
|
8d9706 |
SDL_LoadBMP_RW() function, invalid number of colors is set into
|
|
|
8d9706 |
resulting SDL surface.
|
|
|
8d9706 |
|
|
|
8d9706 |
Then if the SDL surface is passed to SDL_DisplayFormat() function to
|
|
|
8d9706 |
convert the surface format into a native video format, a buffer
|
|
|
8d9706 |
overread will happen in Map1to1() or Map1toN() function
|
|
|
8d9706 |
(CVE-2019-7638). (The choice of the mapping function depends on
|
|
|
8d9706 |
a actual video hardware.)
|
|
|
8d9706 |
|
|
|
8d9706 |
In addition SDL_GetRGB() called indirectly from SDL_DisplayFormat()
|
|
|
8d9706 |
performs the same buffer overread (CVE-2019-7636).
|
|
|
8d9706 |
|
|
|
8d9706 |
There is also probably a buffer overwrite when the SDL_LoadBMP_RW()
|
|
|
8d9706 |
loads colors from a file.
|
|
|
8d9706 |
|
|
|
8d9706 |
This patch fixes it by refusing loading such badly damaged BMP files.
|
|
|
8d9706 |
|
|
|
8d9706 |
CVE-2019-7638
|
|
|
8d9706 |
https://bugzilla.libsdl.org/show_bug.cgi?id=4500
|
|
|
8d9706 |
CVE-2019-7636
|
|
|
8d9706 |
https://bugzilla.libsdl.org/show_bug.cgi?id=4499
|
|
|
8d9706 |
|
|
|
8d9706 |
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
|
|
8d9706 |
---
|
|
|
8d9706 |
src/video/SDL_bmp.c | 4 ++++
|
|
|
8d9706 |
1 file changed, 4 insertions(+)
|
|
|
8d9706 |
|
|
|
8d9706 |
diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c
|
|
|
8d9706 |
index c1f1a24f5..118181b51 100644
|
|
|
8d9706 |
--- a/src/video/SDL_bmp.c
|
|
|
8d9706 |
+++ b/src/video/SDL_bmp.c
|
|
|
8d9706 |
@@ -238,6 +238,10 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops *src, int freesrc)
|
|
|
8d9706 |
if ( palette ) {
|
|
|
8d9706 |
if ( biClrUsed == 0 ) {
|
|
|
8d9706 |
biClrUsed = 1 << biBitCount;
|
|
|
8d9706 |
+ } else if ( biClrUsed > (1 << biBitCount) ) {
|
|
|
8d9706 |
+ SDL_SetError("BMP file has an invalid number of colors");
|
|
|
8d9706 |
+ was_error = SDL_TRUE;
|
|
|
8d9706 |
+ goto done;
|
|
|
8d9706 |
}
|
|
|
8d9706 |
if ( biSize == 12 ) {
|
|
|
8d9706 |
for ( i = 0; i < (int)biClrUsed; ++i ) {
|
|
|
8d9706 |
--
|
|
|
8d9706 |
2.24.1
|
|
|
8d9706 |
|