Sam Lantinga 8bc59f87ec Fixed CVE-2019-7635 and bug 4498 - Heap-Buffer Overflow in Blit1to4 pertaining to SDL_blit_1.c
Petr Pisar

The root cause is that the POC BMP file declares 3 colors used and 4 bpp palette, but pixel at line 28 and column 1 (counted from 0) has color number 3. Then when the image loaded into a surface is passed to SDL_DisplayFormat(), in order to convert it to a video format, a used bliting function looks up a color number 3 in a 3-element long color bliting map. (The map obviously has the same number entries as the surface format has colors.)

Proper fix should refuse broken BMP images that have a pixel with a color index higher than declared number of "used" colors. Possibly more advanced fix could try to relocate the out-of-range color index into a vacant index (if such exists).
2019-03-16 18:34:33 -07:00
2019-03-16 17:39:15 -07:00
2018-11-02 21:34:17 -04:00
2019-01-04 22:01:14 -08:00
2019-01-04 22:01:14 -08:00
2018-11-15 07:20:02 +03:00
2019-03-16 17:39:15 -07:00
2019-01-04 22:01:14 -08:00

                         Simple DirectMedia Layer

                                  (SDL)

                                Version 2.0

---
https://www.libsdl.org/

Simple DirectMedia Layer is a cross-platform development library designed
to provide low level access to audio, keyboard, mouse, joystick, and graphics
hardware via OpenGL and Direct3D. It is used by video playback software,
emulators, and popular games including Valve's award winning catalog
and many Humble Bundle games.

More extensive documentation is available in the docs directory, starting
with README.md

Enjoy!
	Sam Lantinga				(slouken@libsdl.org)
Description
No description provided
Readme 169 MiB
Languages
C 90.3%
Objective-C 3.5%
C++ 1.7%
CMake 1.7%
Java 0.8%
Other 1.8%