src/SDL_internal.h
author Sam Lantinga <slouken@libsdl.org>
Mon, 18 Feb 2019 07:50:33 -0800
changeset 12612 07c39cbbeacf
parent 12503 806492103856
permissions -rw-r--r--
Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pixels.c

Petr Pisar

The reproducer has these data in BITMAPINFOHEADER:

biSize = 40
biBitCount = 8
biClrUsed = 131075

SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount.
     1 /*
     2   Simple DirectMedia Layer
     3   Copyright (C) 1997-2019 Sam Lantinga <slouken@libsdl.org>
     4 
     5   This software is provided 'as-is', without any express or implied
     6   warranty.  In no event will the authors be held liable for any damages
     7   arising from the use of this software.
     8 
     9   Permission is granted to anyone to use this software for any purpose,
    10   including commercial applications, and to alter it and redistribute it
    11   freely, subject to the following restrictions:
    12 
    13   1. The origin of this software must not be misrepresented; you must not
    14      claim that you wrote the original software. If you use this software
    15      in a product, an acknowledgment in the product documentation would be
    16      appreciated but is not required.
    17   2. Altered source versions must be plainly marked as such, and must not be
    18      misrepresented as being the original software.
    19   3. This notice may not be removed or altered from any source distribution.
    20 */
    21 #ifndef SDL_internal_h_
    22 #define SDL_internal_h_
    23 
    24 /* Many of SDL's features require _GNU_SOURCE on various platforms */
    25 #ifndef _GNU_SOURCE
    26 #define _GNU_SOURCE
    27 #endif
    28 
    29 /* This is for a variable-length array at the end of a struct:
    30     struct x { int y; char z[SDL_VARIABLE_LENGTH_ARRAY]; };
    31    Use this because GCC 2 needs different magic than other compilers. */
    32 #if (defined(__GNUC__) && (__GNUC__ <= 2)) || defined(__CC_ARM) || defined(__cplusplus)
    33 #define SDL_VARIABLE_LENGTH_ARRAY 1
    34 #else
    35 #define SDL_VARIABLE_LENGTH_ARRAY
    36 #endif
    37 
    38 #define SDL_MAX_SMALL_ALLOC_STACKSIZE 128
    39 #define SDL_small_alloc(type, count, pisstack) ( (*(pisstack) = ((sizeof(type)*(count)) < SDL_MAX_SMALL_ALLOC_STACKSIZE)), (*(pisstack) ? SDL_stack_alloc(type, count) : (type*)SDL_malloc(sizeof(type)*(count))) )
    40 #define SDL_small_free(ptr, isstack) if ((isstack)) { SDL_stack_free(ptr); } else { SDL_free(ptr); }
    41 
    42 #include "dynapi/SDL_dynapi.h"
    43 
    44 #if SDL_DYNAMIC_API
    45 #include "dynapi/SDL_dynapi_overrides.h"
    46 /* force DECLSPEC and SDLCALL off...it's all internal symbols now.
    47    These will have actual #defines during SDL_dynapi.c only */
    48 #define DECLSPEC
    49 #define SDLCALL
    50 #endif
    51 
    52 #include "SDL_config.h"
    53 
    54 #endif /* SDL_internal_h_ */
    55 
    56 /* vi: set ts=4 sw=4 expandtab: */