| Brad Bishop | 64c979e | 2019-11-04 13:55:29 -0500 | [diff] [blame^] | 1 | From 85138c1ec673e05263ae666baf61f79384daf7e0 Mon Sep 17 00:00:00 2001 |
| 2 | From: Sam Lantinga <slouken@libsdl.org> |
| 3 | Date: Tue, 30 Jul 2019 11:00:00 -0700 |
| 4 | Subject: [PATCH] Fixed bug 4538 - validate image size when loading BMP files |
| 5 | |
| 6 | Upstream-Status: Backport |
| 7 | [https://hg.libsdl.org/SDL/rev/e7ba650a643a] |
| 8 | |
| 9 | CVE: CVE-2019-13616 |
| 10 | |
| 11 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> |
| 12 | --- |
| 13 | src/video/SDL_bmp.c | 5 +++++ |
| 14 | 1 file changed, 5 insertions(+) |
| 15 | |
| 16 | diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c |
| 17 | index 0b68918..a06b0c9 100644 |
| 18 | --- a/src/video/SDL_bmp.c |
| 19 | +++ b/src/video/SDL_bmp.c |
| 20 | @@ -226,6 +226,11 @@ SDL_LoadBMP_RW(SDL_RWops * src, int freesrc) |
| 21 | SDL_RWseek(src, (biSize - headerSize), RW_SEEK_CUR); |
| 22 | } |
| 23 | } |
| 24 | + if (biWidth <= 0 || biHeight == 0) { |
| 25 | + SDL_SetError("BMP file with bad dimensions (%dx%d)", biWidth, biHeight); |
| 26 | + was_error = SDL_TRUE; |
| 27 | + goto done; |
| 28 | + } |
| 29 | if (biHeight < 0) { |
| 30 | topDown = SDL_TRUE; |
| 31 | biHeight = -biHeight; |
| 32 | -- |
| 33 | 2.7.4 |
| 34 | |