From 691f04965faf58d9d6323898478916ae306d046c Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Mon, 14 Oct 2019 14:43:15 +0800 Subject: libsdl2: fix CVE-2019-13616 Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-13616 Patch from: https://hg.libsdl.org/SDL/rev/e7ba650a643a Signed-off-by: Yi Zhao Signed-off-by: Richard Purdie (cherry picked from commit 70b9cdf86b9c5ed14937500619387a890a57ef20) Signed-off-by: Armin Kuster --- ...538-validate-image-size-when-loading-BMP-.patch | 34 ++++++++++++++++++++++ meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-graphics/libsdl2/libsdl2/0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch diff --git a/meta/recipes-graphics/libsdl2/libsdl2/0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch b/meta/recipes-graphics/libsdl2/libsdl2/0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch new file mode 100644 index 0000000000..674decccbb --- /dev/null +++ b/meta/recipes-graphics/libsdl2/libsdl2/0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch @@ -0,0 +1,34 @@ +From 85138c1ec673e05263ae666baf61f79384daf7e0 Mon Sep 17 00:00:00 2001 +From: Sam Lantinga +Date: Tue, 30 Jul 2019 11:00:00 -0700 +Subject: [PATCH] Fixed bug 4538 - validate image size when loading BMP files + +Upstream-Status: Backport +[https://hg.libsdl.org/SDL/rev/e7ba650a643a] + +CVE: CVE-2019-13616 + +Signed-off-by: Yi Zhao +--- + src/video/SDL_bmp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c +index 0b68918..a06b0c9 100644 +--- a/src/video/SDL_bmp.c ++++ b/src/video/SDL_bmp.c +@@ -226,6 +226,11 @@ SDL_LoadBMP_RW(SDL_RWops * src, int freesrc) + SDL_RWseek(src, (biSize - headerSize), RW_SEEK_CUR); + } + } ++ if (biWidth <= 0 || biHeight == 0) { ++ SDL_SetError("BMP file with bad dimensions (%dx%d)", biWidth, biHeight); ++ was_error = SDL_TRUE; ++ goto done; ++ } + if (biHeight < 0) { + topDown = SDL_TRUE; + biHeight = -biHeight; +-- +2.7.4 + diff --git a/meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb b/meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb index 3a0654b866..cdc8650e17 100644 --- a/meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb +++ b/meta/recipes-graphics/libsdl2/libsdl2_2.0.10.bb @@ -14,6 +14,7 @@ PROVIDES = "virtual/libsdl2" SRC_URI = "http://www.libsdl.org/release/SDL2-${PV}.tar.gz \ file://more-gen-depends.patch \ + file://0001-Fixed-bug-4538-validate-image-size-when-loading-BMP-.patch \ " S = "${WORKDIR}/SDL2-${PV}" -- cgit 1.2.3-korg