summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorYi Zhao <yi.zhao@windriver.com>2019-10-14 14:43:15 +0800
committerArmin Kuster <akuster808@gmail.com>2019-10-25 23:44:33 -0700
commit691f04965faf58d9d6323898478916ae306d046c (patch)
tree7bfd286a8e2052d032954315403653eb3fb78e80
parent5c11937348debf57e3a87c7c6a6c0429fd756eca (diff)
downloadopenembedded-core-contrib-691f04965faf58d9d6323898478916ae306d046c.tar.gz
openembedded-core-contrib-691f04965faf58d9d6323898478916ae306d046c.tar.bz2
openembedded-core-contrib-691f04965faf58d9d6323898478916ae306d046c.zip
libsdl2: fix CVE-2019-13616
Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-13616 Patch from: https://hg.libsdl.org/SDL/rev/e7ba650a643a Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 70b9cdf86b9c5ed14937500619387a890a57ef20) Signed-off-by: Armin Kuster <akuster808@gmail.com>
-rw-r--r--meta/recipes-graphics/libsdl2/libsdl2/0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch34
-rw-r--r--meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb1
2 files changed, 35 insertions, 0 deletions
diff --git a/meta/recipes-graphics/libsdl2/libsdl2/0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch b/meta/recipes-graphics/libsdl2/libsdl2/0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch
new file mode 100644
index 0000000000..674decccbb
--- /dev/null
+++ b/meta/recipes-graphics/libsdl2/libsdl2/0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch
@@ -0,0 +1,34 @@
+From 85138c1ec673e05263ae666baf61f79384daf7e0 Mon Sep 17 00:00:00 2001
+From: Sam Lantinga <slouken@libsdl.org>
+Date: Tue, 30 Jul 2019 11:00:00 -0700
+Subject: [PATCH] Fixed bug 4538 - validate image size when loading BMP files
+
+Upstream-Status: Backport
+[https://hg.libsdl.org/SDL/rev/e7ba650a643a]
+
+CVE: CVE-2019-13616
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ src/video/SDL_bmp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c
+index 0b68918..a06b0c9 100644
+--- a/src/video/SDL_bmp.c
++++ b/src/video/SDL_bmp.c
+@@ -226,6 +226,11 @@ SDL_LoadBMP_RW(SDL_RWops * src, int freesrc)
+ SDL_RWseek(src, (biSize - headerSize), RW_SEEK_CUR);
+ }
+ }
++ if (biWidth <= 0 || biHeight == 0) {
++ SDL_SetError("BMP file with bad dimensions (%dx%d)", biWidth, biHeight);
++ was_error = SDL_TRUE;
++ goto done;
++ }
+ if (biHeight < 0) {
+ topDown = SDL_TRUE;
+ biHeight = -biHeight;
+--
+2.7.4
+
diff --git a/meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb b/meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb
index 3a0654b866..cdc8650e17 100644
--- a/meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb
+++ b/meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb
@@ -14,6 +14,7 @@ PROVIDES = "virtual/libsdl2"
SRC_URI = "http://www.libsdl.org/release/SDL2-${PV}.tar.gz \
file://more-gen-depends.patch \
+ file://0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch \
"
S = "${WORKDIR}/SDL2-${PV}"