From e31374d045594938670f65e8f2f864ce2fa15b9e Mon Sep 17 00:00:00 2001 From: Ozkan Sezer Date: Thu, 11 Jul 2019 00:55:02 +0300 Subject: [PATCH] bmp: backport CVE-2019-7635 (SDL bug 4498) fix from main 2.0 branch: mainstream commit: https://hg.libsdl.org/SDL_image/rev/03bd33e8cb49 --- IMG_bmp.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/IMG_bmp.c b/IMG_bmp.c index 2cc1fbe4..bb2517b8 100644 --- a/IMG_bmp.c +++ b/IMG_bmp.c @@ -292,6 +292,14 @@ static SDL_Surface *LoadBMP_RW (SDL_RWops *src, int freesrc) ExpandBMP = biBitCount; biBitCount = 8; break; + case 2: + case 3: + case 5: + case 6: + case 7: + IMG_SetError("%d-bpp BMP images are not supported", biBitCount); + was_error = SDL_TRUE; + goto done; default: ExpandBMP = 0; break; @@ -444,7 +452,12 @@ static SDL_Surface *LoadBMP_RW (SDL_RWops *src, int freesrc) goto done; } } - *(bits+i) = (pixel>>shift); + bits[i] = (pixel >> shift); + if (bits[i] >= biClrUsed) { + IMG_SetError("A BMP image contains a pixel with a color out of the palette"); + was_error = SDL_TRUE; + goto done; + } pixel <<= ExpandBMP; } } break; @@ -456,6 +469,15 @@ static SDL_Surface *LoadBMP_RW (SDL_RWops *src, int freesrc) was_error = SDL_TRUE; goto done; } + if (biBitCount == 8 && palette && biClrUsed < (1 << biBitCount)) { + for (i = 0; i < surface->w; ++i) { + if (bits[i] >= biClrUsed) { + IMG_SetError("A BMP image contains a pixel with a color out of the palette"); + was_error = SDL_TRUE; + goto done; + } + } + } #if SDL_BYTEORDER == SDL_BIG_ENDIAN /* Byte-swap the pixels if needed. Note that the 24bpp case has already been taken care of above. */