From 4210e9cb2abfdfc80b8ea045d269df425bef535f Mon Sep 17 00:00:00 2001 From: wangmy Date: Tue, 18 May 2021 16:09:11 +0800 Subject: libsdl: Fix CVE-2019-13616 References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13616 SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c. Upstream-Status: Backport [https://github.com/libsdl-org/SDL/commit/97fefd050976bbbfca9608499f6a7d9fb86e70db] CVE: CVE-2019-13616 Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 57ae91d2914de96b1de69bfcb089a427ee3cb0ed) Signed-off-by: Armin Kuster --- .../libsdl/libsdl-1.2.15/CVE-2019-13616.patch | 27 ++++++++++++++++++++++ meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb | 1 + 2 files changed, 28 insertions(+) create mode 100644 meta-oe/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-13616.patch diff --git a/meta-oe/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-13616.patch b/meta-oe/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-13616.patch new file mode 100644 index 0000000000..2db67966cf --- /dev/null +++ b/meta-oe/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-13616.patch @@ -0,0 +1,27 @@ +From 97fefd050976bbbfca9608499f6a7d9fb86e70db Mon Sep 17 00:00:00 2001 +From: Sam Lantinga +Date: Tue, 30 Jul 2019 11:00:00 -0700 +Subject: [PATCH] Fixed bug 4538 - validate image size when loading BMP files +--- + src/video/SDL_bmp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c +index 8eadc5f..5b5e12c 100644 +--- a/src/video/SDL_bmp.c ++++ b/src/video/SDL_bmp.c +@@ -143,6 +143,11 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops *src, int freesrc) + (void) biYPelsPerMeter; + (void) biClrImportant; + ++ if (biWidth <= 0 || biHeight == 0) { ++ SDL_SetError("BMP file with bad dimensions (%dx%d)", biWidth, biHeight); ++ was_error = SDL_TRUE; ++ goto done; ++ } + if (biHeight < 0) { + topDown = SDL_TRUE; + biHeight = -biHeight; +-- +2.25.1 + diff --git a/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb b/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb index 7a01908322..d91a1856b4 100644 --- a/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb +++ b/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb @@ -27,6 +27,7 @@ SRC_URI = "http://www.libsdl.org/release/SDL-${PV}.tar.gz \ file://CVE-2019-7637.patch \ file://CVE-2019-7638.patch \ file://CVE-2019-7576.patch \ + file://CVE-2019-13616.patch \ " UPSTREAM_CHECK_REGEX = "SDL-(?P\d+(\.\d+)+)\.tar" -- cgit 1.2.3-korg