src/thread/SDL_systhread.h
author Sam Lantinga <slouken@libsdl.org>
Mon, 18 Feb 2019 07:50:33 -0800
changeset 12612 07c39cbbeacf
parent 12503 806492103856
permissions -rw-r--r--
Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pixels.c

Petr Pisar

The reproducer has these data in BITMAPINFOHEADER:

biSize = 40
biBitCount = 8
biClrUsed = 131075

SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount.
     1 /*
     2   Simple DirectMedia Layer
     3   Copyright (C) 1997-2019 Sam Lantinga <slouken@libsdl.org>
     4 
     5   This software is provided 'as-is', without any express or implied
     6   warranty.  In no event will the authors be held liable for any damages
     7   arising from the use of this software.
     8 
     9   Permission is granted to anyone to use this software for any purpose,
    10   including commercial applications, and to alter it and redistribute it
    11   freely, subject to the following restrictions:
    12 
    13   1. The origin of this software must not be misrepresented; you must not
    14      claim that you wrote the original software. If you use this software
    15      in a product, an acknowledgment in the product documentation would be
    16      appreciated but is not required.
    17   2. Altered source versions must be plainly marked as such, and must not be
    18      misrepresented as being the original software.
    19   3. This notice may not be removed or altered from any source distribution.
    20 */
    21 #include "../SDL_internal.h"
    22 
    23 /* These are functions that need to be implemented by a port of SDL */
    24 
    25 #ifndef SDL_systhread_h_
    26 #define SDL_systhread_h_
    27 
    28 #include "SDL_thread.h"
    29 #include "SDL_thread_c.h"
    30 
    31 /* This function creates a thread, passing args to SDL_RunThread(),
    32    saves a system-dependent thread id in thread->id, and returns 0
    33    on success.
    34 */
    35 #ifdef SDL_PASSED_BEGINTHREAD_ENDTHREAD
    36 extern int SDL_SYS_CreateThread(SDL_Thread * thread, void *args,
    37                                 pfnSDL_CurrentBeginThread pfnBeginThread,
    38                                 pfnSDL_CurrentEndThread pfnEndThread);
    39 #else
    40 extern int SDL_SYS_CreateThread(SDL_Thread * thread, void *args);
    41 #endif
    42 
    43 /* This function does any necessary setup in the child thread */
    44 extern void SDL_SYS_SetupThread(const char *name);
    45 
    46 /* This function sets the current thread priority */
    47 extern int SDL_SYS_SetThreadPriority(SDL_ThreadPriority priority);
    48 
    49 /* This function waits for the thread to finish and frees any data
    50    allocated by SDL_SYS_CreateThread()
    51  */
    52 extern void SDL_SYS_WaitThread(SDL_Thread * thread);
    53 
    54 /* Mark thread as cleaned up as soon as it exits, without joining. */
    55 extern void SDL_SYS_DetachThread(SDL_Thread * thread);
    56 
    57 /* Get the thread local storage for this thread */
    58 extern SDL_TLSData *SDL_SYS_GetTLSData(void);
    59 
    60 /* Set the thread local storage for this thread */
    61 extern int SDL_SYS_SetTLSData(SDL_TLSData *data);
    62 
    63 /* This is for internal SDL use, so we don't need #ifdefs everywhere. */
    64 extern SDL_Thread *
    65 SDL_CreateThreadInternal(int (SDLCALL * fn) (void *), const char *name,
    66                          const size_t stacksize, void *data);
    67 
    68 #endif /* SDL_systhread_h_ */
    69 
    70 /* vi: set ts=4 sw=4 expandtab: */