geemili
/
SDL
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pixels.c 

Petr Pisar

The reproducer has these data in BITMAPINFOHEADER:

biSize = 40
biBitCount = 8
biClrUsed = 131075

SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount.
Sam Lantinga 2019-02-18 07:50:33 -08:00
parent afd1b3dae4
commit ea4c4cfc28
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/video/SDL_bmp.c
View File

@ -313,6 +313,10 @@ SDL_LoadBMP_RW(SDL_RWops * src, int freesrc)
SDL_assert(biBitCount <= 8); SDL_assert(biBitCount <= 8);
if (biClrUsed == 0) { if (biClrUsed == 0) {
biClrUsed = 1 << biBitCount; biClrUsed = 1 << biBitCount;
} else if (biClrUsed > (1 << biBitCount)) {
SDL_SetError("BMP file has an invalid number of colors");
was_error = SDL_TRUE;
goto done;
} }
if ((int) biClrUsed > palette->ncolors) { if ((int) biClrUsed > palette->ncolors) {
SDL_Color *colors; SDL_Color *colors;