README.txt
author Sam Lantinga <slouken@libsdl.org>
Mon, 18 Feb 2019 07:50:33 -0800
changeset 12612 07c39cbbeacf
parent 10890 a2ec89f77e6b
permissions -rw-r--r--
Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pixels.c

Petr Pisar

The reproducer has these data in BITMAPINFOHEADER:

biSize = 40
biBitCount = 8
biClrUsed = 131075

SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount.
     1 
     2                          Simple DirectMedia Layer
     3 
     4                                   (SDL)
     5 
     6                                 Version 2.0
     7 
     8 ---
     9 https://www.libsdl.org/
    10 
    11 Simple DirectMedia Layer is a cross-platform development library designed
    12 to provide low level access to audio, keyboard, mouse, joystick, and graphics
    13 hardware via OpenGL and Direct3D. It is used by video playback software,
    14 emulators, and popular games including Valve's award winning catalog
    15 and many Humble Bundle games.
    16 
    17 More extensive documentation is available in the docs directory, starting
    18 with README.md
    19 
    20 Enjoy!
    21 	Sam Lantinga				(slouken@libsdl.org)