1*4882a593Smuzhiyun# HG changeset patch 2*4882a593Smuzhiyun# User Petr Písař <ppisar@redhat.com> 3*4882a593Smuzhiyun# Date 1560259692 25200 4*4882a593Smuzhiyun# Tue Jun 11 06:28:12 2019 -0700 5*4882a593Smuzhiyun# Branch SDL-1.2 6*4882a593Smuzhiyun# Node ID f1f5878be5dbf63c1161a8ee52b8a86ece30e552 7*4882a593Smuzhiyun# Parent a936f9bd3e381d67d8ddee8b9243f85799ea4798 8*4882a593SmuzhiyunCVE-2019-7635: Reject BMP images with pixel colors out the palette 9*4882a593SmuzhiyunIf a 1-, 4-, or 8-bit per pixel BMP image declares less used colors 10*4882a593Smuzhiyunthan the palette offers an SDL_Surface with a palette of the indicated 11*4882a593Smuzhiyunnumber of used colors is created. If some of the image's pixel 12*4882a593Smuzhiyunrefer to a color number higher then the maximal used colors, a subsequent 13*4882a593Smuzhiyunbliting operation on the surface will look up a color past a blit map 14*4882a593Smuzhiyun(that is based on the palette) memory. I.e. passing such SDL_Surface 15*4882a593Smuzhiyunto e.g. an SDL_DisplayFormat() function will result in a buffer overread in 16*4882a593Smuzhiyuna blit function. 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunThis patch fixes it by validing each pixel's color to be less than the 19*4882a593Smuzhiyunmaximal color number in the palette. A validation failure raises an 20*4882a593Smuzhiyunerror from a SDL_LoadBMP_RW() function. 21*4882a593Smuzhiyun 22*4882a593SmuzhiyunCVE-2019-7635 23*4882a593Smuzhiyunhttps://bugzilla.libsdl.org/show_bug.cgi?id=4498 24*4882a593Smuzhiyun 25*4882a593SmuzhiyunSigned-off-by: Petr Písař <ppisar@redhat.com> 26*4882a593Smuzhiyun 27*4882a593SmuzhiyunCVE: CVE-2019-7635 28*4882a593SmuzhiyunUpstream-Status: Backport 29*4882a593SmuzhiyunSigned-off-by: Anuj Mittal <anuj.mittal@intel.com> 30*4882a593Smuzhiyun 31*4882a593Smuzhiyundiff -r a936f9bd3e38 -r f1f5878be5db src/video/SDL_bmp.c 32*4882a593Smuzhiyun--- a/src/video/SDL_bmp.c Mon Jun 10 09:25:05 2019 -0700 33*4882a593Smuzhiyun+++ b/src/video/SDL_bmp.c Tue Jun 11 06:28:12 2019 -0700 34*4882a593Smuzhiyun@@ -308,6 +308,12 @@ 35*4882a593Smuzhiyun } 36*4882a593Smuzhiyun *(bits+i) = (pixel>>shift); 37*4882a593Smuzhiyun pixel <<= ExpandBMP; 38*4882a593Smuzhiyun+ if ( bits[i] >= biClrUsed ) { 39*4882a593Smuzhiyun+ SDL_SetError( 40*4882a593Smuzhiyun+ "A BMP image contains a pixel with a color out of the palette"); 41*4882a593Smuzhiyun+ was_error = SDL_TRUE; 42*4882a593Smuzhiyun+ goto done; 43*4882a593Smuzhiyun+ } 44*4882a593Smuzhiyun } } 45*4882a593Smuzhiyun break; 46*4882a593Smuzhiyun 47*4882a593Smuzhiyun@@ -318,6 +324,16 @@ 48*4882a593Smuzhiyun was_error = SDL_TRUE; 49*4882a593Smuzhiyun goto done; 50*4882a593Smuzhiyun } 51*4882a593Smuzhiyun+ if ( 8 == biBitCount && palette && biClrUsed < (1 << biBitCount ) ) { 52*4882a593Smuzhiyun+ for ( i=0; i<surface->w; ++i ) { 53*4882a593Smuzhiyun+ if ( bits[i] >= biClrUsed ) { 54*4882a593Smuzhiyun+ SDL_SetError( 55*4882a593Smuzhiyun+ "A BMP image contains a pixel with a color out of the palette"); 56*4882a593Smuzhiyun+ was_error = SDL_TRUE; 57*4882a593Smuzhiyun+ goto done; 58*4882a593Smuzhiyun+ } 59*4882a593Smuzhiyun+ } 60*4882a593Smuzhiyun+ } 61*4882a593Smuzhiyun #if SDL_BYTEORDER == SDL_BIG_ENDIAN 62*4882a593Smuzhiyun /* Byte-swap the pixels if needed. Note that the 24bpp 63*4882a593Smuzhiyun case has already been taken care of above. */ 64