git.ipfire.org Git - thirdparty/openembedded/openembedded-core-contrib.git/blob

   1 From 85138c1ec673e05263ae666baf61f79384daf7e0 Mon Sep 17 00:00:00 2001
   2 From: Sam Lantinga <slouken@libsdl.org>
   3 Date: Tue, 30 Jul 2019 11:00:00 -0700
   4 Subject: [PATCH] Fixed bug 4538 - validate image size when loading BMP files
   5
   6 Upstream-Status: Backport
   7 [https://hg.libsdl.org/SDL/rev/e7ba650a643a]
   8
   9 CVE: CVE-2019-13616
  10
  11 Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
  12 ---
  13  src/video/SDL_bmp.c | 5 +++++
  14  1 file changed, 5 insertions(+)
  15
  16 diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c
  17 index 0b68918..a06b0c9 100644
  18 --- a/src/video/SDL_bmp.c
  19 +++ b/src/video/SDL_bmp.c
  20 @@ -226,6 +226,11 @@ SDL_LoadBMP_RW(SDL_RWops * src, int freesrc)
  21              SDL_RWseek(src, (biSize - headerSize), RW_SEEK_CUR);
  22          }
  23      }
  24 +    if (biWidth <= 0 || biHeight == 0) {
  25 +        SDL_SetError("BMP file with bad dimensions (%dx%d)", biWidth, biHeight);
  26 +        was_error = SDL_TRUE;
  27 +        goto done;
  28 +    }
  29      if (biHeight < 0) {
  30          topDown = SDL_TRUE;
  31          biHeight = -biHeight;
  32 --
  33 2.7.4
  34