VisualC-WinRT/SDL2main-WinRT-NonXAML.targets
author Sam Lantinga <slouken@libsdl.org>
Mon, 18 Feb 2019 07:50:33 -0800
changeset 12612 07c39cbbeacf
parent 9942 e82bfd942409
permissions -rw-r--r--
Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pixels.c

Petr Pisar

The reproducer has these data in BITMAPINFOHEADER:

biSize = 40
biBitCount = 8
biClrUsed = 131075

SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount.
dludwig@9940
     1
<?xml version="1.0" encoding="utf-8"?>
dludwig@9940
     2
<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
dludwig@9940
     3
dludwig@9940
     4
  <ItemGroup Label="LibSDL2">
dludwig@9940
     5
    <ClCompile Include="$(MSBuildThisFileDirectory)..\..\src\main\winrt\SDL_winrt_main_NonXAML.cpp">
dludwig@9940
     6
      <CompileAsWinRT>true</CompileAsWinRT>
dludwig@9940
     7
    </ClCompile>
dludwig@9940
     8
  </ItemGroup>
dludwig@9940
     9
dludwig@9940
    10
</Project>