aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorwangmy <wangmy@fujitsu.com>2021-05-18 16:09:11 +0800
committerArmin Kuster <akuster808@gmail.com>2021-05-22 15:35:45 -0700
commit4210e9cb2abfdfc80b8ea045d269df425bef535f (patch)
tree7a4dc42eaff1567d12e639e3543ddca587832609
parent93a33c961102742de0874e14ab920ec379eed13e (diff)
downloadmeta-openembedded-4210e9cb2abfdfc80b8ea045d269df425bef535f.tar.gz
meta-openembedded-4210e9cb2abfdfc80b8ea045d269df425bef535f.tar.bz2
meta-openembedded-4210e9cb2abfdfc80b8ea045d269df425bef535f.zip
libsdl: Fix CVE-2019-13616
References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13616 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. Upstream-Status: Backport [https://github.com/libsdl-org/SDL/commit/97fefd050976bbbfca9608499f6a7d9fb86e70db] CVE: CVE-2019-13616 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 57ae91d2914de96b1de69bfcb089a427ee3cb0ed) Signed-off-by: Armin Kuster <akuster808@gmail.com>
-rw-r--r--meta-oe/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-13616.patch27
-rw-r--r--meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb1
2 files changed, 28 insertions, 0 deletions
diff --git a/meta-oe/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-13616.patch b/meta-oe/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-13616.patch
new file mode 100644
index 000000000..2db67966c
--- /dev/null
+++ b/meta-oe/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-13616.patch
@@ -0,0 +1,27 @@
+From 97fefd050976bbbfca9608499f6a7d9fb86e70db Mon Sep 17 00:00:00 2001
+From: Sam Lantinga <slouken@libsdl.org>
+Date: Tue, 30 Jul 2019 11:00:00 -0700
+Subject: [PATCH] Fixed bug 4538 - validate image size when loading BMP files
+---
+ src/video/SDL_bmp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c
+index 8eadc5f..5b5e12c 100644
+--- a/src/video/SDL_bmp.c
++++ b/src/video/SDL_bmp.c
+@@ -143,6 +143,11 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops *src, int freesrc)
+ (void) biYPelsPerMeter;
+ (void) biClrImportant;
+
++ if (biWidth <= 0 || biHeight == 0) {
++ SDL_SetError("BMP file with bad dimensions (%dx%d)", biWidth, biHeight);
++ was_error = SDL_TRUE;
++ goto done;
++ }
+ if (biHeight < 0) {
+ topDown = SDL_TRUE;
+ biHeight = -biHeight;
+--
+2.25.1
+
diff --git a/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb b/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb
index 7a0190832..d91a1856b 100644
--- a/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb
+++ b/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb
@@ -27,6 +27,7 @@ SRC_URI = "http://www.libsdl.org/release/SDL-${PV}.tar.gz \
file://CVE-2019-7637.patch \
file://CVE-2019-7638.patch \
file://CVE-2019-7576.patch \
+ file://CVE-2019-13616.patch \
"
UPSTREAM_CHECK_REGEX = "SDL-(?P<pver>\d+(\.\d+)+)\.tar"