src/SDL_error_c.h
author Sam Lantinga <slouken@libsdl.org>
Mon, 18 Feb 2019 07:50:33 -0800
changeset 12612 07c39cbbeacf
parent 12503 806492103856
permissions -rw-r--r--
Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pixels.c

Petr Pisar

The reproducer has these data in BITMAPINFOHEADER:

biSize = 40
biBitCount = 8
biClrUsed = 131075

SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount.
     1 /*
     2   Simple DirectMedia Layer
     3   Copyright (C) 1997-2019 Sam Lantinga <slouken@libsdl.org>
     4 
     5   This software is provided 'as-is', without any express or implied
     6   warranty.  In no event will the authors be held liable for any damages
     7   arising from the use of this software.
     8 
     9   Permission is granted to anyone to use this software for any purpose,
    10   including commercial applications, and to alter it and redistribute it
    11   freely, subject to the following restrictions:
    12 
    13   1. The origin of this software must not be misrepresented; you must not
    14      claim that you wrote the original software. If you use this software
    15      in a product, an acknowledgment in the product documentation would be
    16      appreciated but is not required.
    17   2. Altered source versions must be plainly marked as such, and must not be
    18      misrepresented as being the original software.
    19   3. This notice may not be removed or altered from any source distribution.
    20 */
    21 #include "./SDL_internal.h"
    22 
    23 /* This file defines a structure that carries language-independent
    24    error messages
    25 */
    26 
    27 #ifndef SDL_error_c_h_
    28 #define SDL_error_c_h_
    29 
    30 #define ERR_MAX_STRLEN  128
    31 #define ERR_MAX_ARGS    5
    32 
    33 typedef struct SDL_error
    34 {
    35     /* This is a numeric value corresponding to the current error */
    36     int error;
    37 
    38     /* This is a key used to index into a language hashtable containing
    39        internationalized versions of the SDL error messages.  If the key
    40        is not in the hashtable, or no hashtable is available, the key is
    41        used directly as an error message format string.
    42      */
    43     char key[ERR_MAX_STRLEN];
    44 
    45     /* These are the arguments for the error functions */
    46     int argc;
    47     union
    48     {
    49         void *value_ptr;
    50 #if 0                           /* What is a character anyway?  (UNICODE issues) */
    51         unsigned char value_c;
    52 #endif
    53         int value_i;
    54         long value_l;
    55         double value_f;
    56         char buf[ERR_MAX_STRLEN];
    57     } args[ERR_MAX_ARGS];
    58 } SDL_error;
    59 
    60 /* Defined in SDL_thread.c */
    61 extern SDL_error *SDL_GetErrBuf(void);
    62 
    63 #endif /* SDL_error_c_h_ */
    64 
    65 /* vi: set ts=4 sw=4 expandtab: */