Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP1:Update
SDL.12361
CVE-2019-7637.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2019-7637.patch of Package SDL.12361
diff --git a/src/video/SDL_pixels.c b/src/video/SDL_pixels.c index 1a7fd51..6448e9b 100644 --- a/src/video/SDL_pixels.c +++ b/src/video/SDL_pixels.c @@ -286,26 +286,56 @@ void SDL_DitherColors(SDL_Color *colors, int bpp) } } /* - * Calculate the pad-aligned scanline width of a surface + * Calculate the pad-aligned scanline width of a surface. Return 0 in case of + * an error. */ Uint16 SDL_CalculatePitch(SDL_Surface *surface) { - Uint16 pitch; - + unsigned int pitch = 0; + Uint8 byte = 0; /* Surface should be 4-byte aligned for speed */ - pitch = surface->w*surface->format->BytesPerPixel; + /* The code tries to prevent from an Uint16 overflow. */ + for (byte = surface->format->BytesPerPixel; byte; byte--) { + pitch += (unsigned int)surface->w; + if (pitch < surface->w) { + SDL_SetError("A scanline is too wide"); + return(0); + } + } + switch (surface->format->BitsPerPixel) { case 1: - pitch = (pitch+7)/8; + if (pitch % 8) { + pitch = pitch / 8 + 1; + } else { + pitch = pitch / 8; + } break; case 4: - pitch = (pitch+1)/2; + if (pitch % 2) { + pitch = pitch / 2 + 1; + } else { + pitch = pitch / 2; + } break; default: break; } - pitch = (pitch + 3) & ~3; /* 4-byte aligning */ - return(pitch); + + /* 4-byte aligning */ + if (pitch & 3) { + if (pitch + 3 < pitch) { + SDL_SetError("A scanline is too wide"); + return(0); + } + pitch = (pitch + 3) & ~3; + } + if (pitch > 0xFFFF) { + SDL_SetError("A scanline is too wide"); + return(0); + } + + return((Uint16)pitch); } /* * Match an RGB value to a particular palette index diff --git a/src/video/gapi/SDL_gapivideo.c b/src/video/gapi/SDL_gapivideo.c index 86deadc..8a06485 100644 --- a/src/video/gapi/SDL_gapivideo.c +++ b/src/video/gapi/SDL_gapivideo.c @@ -733,6 +733,9 @@ SDL_Surface *GAPI_SetVideoMode(_THIS, SDL_Surface *current, video->w = gapi->w = width; video->h = gapi->h = height; video->pitch = SDL_CalculatePitch(video); + if (!current->pitch) { + return(NULL); + } /* Small fix for WinCE/Win32 - when activating window SDL_VideoSurface is equal to zero, so activating code diff --git a/src/video/nanox/SDL_nxvideo.c b/src/video/nanox/SDL_nxvideo.c index b188e09..cbdd09a 100644 --- a/src/video/nanox/SDL_nxvideo.c +++ b/src/video/nanox/SDL_nxvideo.c @@ -378,6 +378,10 @@ SDL_Surface * NX_SetVideoMode (_THIS, SDL_Surface * current, current -> w = width ; current -> h = height ; current -> pitch = SDL_CalculatePitch (current) ; + if (!current->pitch) { + current = NULL; + goto done; + } NX_ResizeImage (this, current, flags) ; } diff --git a/src/video/ps2gs/SDL_gsvideo.c b/src/video/ps2gs/SDL_gsvideo.c index e172c60..3290866 100644 --- a/src/video/ps2gs/SDL_gsvideo.c +++ b/src/video/ps2gs/SDL_gsvideo.c @@ -479,6 +479,9 @@ static SDL_Surface *GS_SetVideoMode(_THIS, SDL_Surface *current, current->w = width; current->h = height; current->pitch = SDL_CalculatePitch(current); + if (!current->pitch) { + return(NULL); + } /* Memory map the DMA area for block memory transfer */ if ( ! mapped_mem ) { diff --git a/src/video/ps3/SDL_ps3video.c b/src/video/ps3/SDL_ps3video.c index d5519e0..17848e3 100644 --- a/src/video/ps3/SDL_ps3video.c +++ b/src/video/ps3/SDL_ps3video.c @@ -339,6 +339,9 @@ static SDL_Surface *PS3_SetVideoMode(_THIS, SDL_Surface * current, int width, in current->w = width; current->h = height; current->pitch = SDL_CalculatePitch(current); + if (!current->pitch) { + return(NULL); + } /* Alloc aligned mem for current->pixels */ s_pixels = memalign(16, current->h * current->pitch); diff --git a/src/video/windib/SDL_dibvideo.c b/src/video/windib/SDL_dibvideo.c index 6187bfc..86ebb12 100644 --- a/src/video/windib/SDL_dibvideo.c +++ b/src/video/windib/SDL_dibvideo.c @@ -675,6 +675,9 @@ SDL_Surface *DIB_SetVideoMode(_THIS, SDL_Surface *current, video->w = width; video->h = height; video->pitch = SDL_CalculatePitch(video); + if (!current->pitch) { + return(NULL); + } /* Small fix for WinCE/Win32 - when activating window SDL_VideoSurface is equal to zero, so activating code diff --git a/src/video/windx5/SDL_dx5video.c b/src/video/windx5/SDL_dx5video.c index f80ca97..39fc4fc 100644 --- a/src/video/windx5/SDL_dx5video.c +++ b/src/video/windx5/SDL_dx5video.c @@ -1127,6 +1127,9 @@ SDL_Surface *DX5_SetVideoMode(_THIS, SDL_Surface *current, video->w = width; video->h = height; video->pitch = SDL_CalculatePitch(video); + if (!current->pitch) { + return(NULL); + } #ifndef NO_CHANGEDISPLAYSETTINGS /* Set fullscreen mode if appropriate. diff --git a/src/video/x11/SDL_x11video.c b/src/video/x11/SDL_x11video.c index 670a2d8..9521b49 100644 --- a/src/video/x11/SDL_x11video.c +++ b/src/video/x11/SDL_x11video.c @@ -1218,6 +1218,10 @@ SDL_Surface *X11_SetVideoMode(_THIS, SDL_Surface *current, current->w = width; current->h = height; current->pitch = SDL_CalculatePitch(current); + if (!current->pitch) { + current = NULL; + goto done; + } if (X11_ResizeImage(this, current, flags) < 0) { current = NULL; goto done;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
