1 files changed, 63 insertions, 0 deletions
diff --git a/meta/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-7635.patch b/meta/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-7635.patch
new file mode 100644
index 0000000000..78af1b061d
--- /dev/null
+++ b/meta/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-7635.patch
@@ -0,0 +1,63 @@
+# HG changeset patch
+# User Petr Písař <ppisar@redhat.com>
+# Date 1560259692 25200
+#      Tue Jun 11 06:28:12 2019 -0700
+# Branch SDL-1.2
+# Node ID f1f5878be5dbf63c1161a8ee52b8a86ece30e552
+# Parent  a936f9bd3e381d67d8ddee8b9243f85799ea4798
+CVE-2019-7635: Reject BMP images with pixel colors out the palette
+If a 1-, 4-, or 8-bit per pixel BMP image declares less used colors
+than the palette offers an SDL_Surface with a palette of the indicated
+number of used colors is created. If some of the image's pixel
+refer to a color number higher then the maximal used colors, a subsequent
+bliting operation on the surface will look up a color past a blit map
+(that is based on the palette) memory. I.e. passing such SDL_Surface
+to e.g. an SDL_DisplayFormat() function will result in a buffer overread in
+a blit function.
+This patch fixes it by validing each pixel's color to be less than the
+maximal color number in the palette. A validation failure raises an
+error from a SDL_LoadBMP_RW() function.
+CVE-2019-7635
+https://bugzilla.libsdl.org/show_bug.cgi?id=4498
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+CVE: CVE-2019-7635
+Upstream-Status: Backport
+Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
+diff -r a936f9bd3e38 -r f1f5878be5db src/video/SDL_bmp.c
+--- a/src/video/SDL_bmp.c       Mon Jun 10 09:25:05 2019 -0700
+++ b/src/video/SDL_bmp.c       Tue Jun 11 06:28:12 2019 -0700
+@@ -308,6 +308,12 @@
+                                }
+                                *(bits+i) = (pixel>>shift);
+                                pixel <<= ExpandBMP;
+                               if ( bits[i] >= biClrUsed ) {
+                                       SDL_SetError(
+                                               "A BMP image contains a pixel with a color out of the palette");
+                                       was_error = SDL_TRUE;
+                                       goto done;
+                               }
+                        } }
+                        break;
+ 
+@@ -318,6 +324,16 @@
+                                was_error = SDL_TRUE;
+                                goto done;
+                        }
+                       if ( 8 == biBitCount && palette && biClrUsed < (1 << biBitCount ) ) {
+                               for ( i=0; i<surface->w; ++i ) {
+                                       if ( bits[i] >= biClrUsed ) {
+                                               SDL_SetError(
+                                                       "A BMP image contains a pixel with a color out of the palette");
+                                               was_error = SDL_TRUE;
+                                               goto done;
+                                       }
+                               }
+                       }
+ #if SDL_BYTEORDER == SDL_BIG_ENDIAN
+                        /* Byte-swap the pixels if needed. Note that the 24bpp
+                           case has already been taken care of above. */

diff --git a/meta/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-7635.patch b/meta/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-7635.patch new file mode 100644 index 0000000000..78af1b061d --- /dev/null +++ b/meta/recipes-graphics/libsdl/libsdl-1.2.15/CVE-2019-7635.patch
@@ -0,0 +1,63 @@
	1	# HG changeset patch
	2	# User Petr Písař <ppisar@redhat.com>
	3	# Date 1560259692 25200
	4	# Tue Jun 11 06:28:12 2019 -0700
	5	# Branch SDL-1.2
	6	# Node ID f1f5878be5dbf63c1161a8ee52b8a86ece30e552
	7	# Parent a936f9bd3e381d67d8ddee8b9243f85799ea4798
	8	CVE-2019-7635: Reject BMP images with pixel colors out the palette
	9	If a 1-, 4-, or 8-bit per pixel BMP image declares less used colors
	10	than the palette offers an SDL_Surface with a palette of the indicated
	11	number of used colors is created. If some of the image's pixel
	12	refer to a color number higher then the maximal used colors, a subsequent
	13	bliting operation on the surface will look up a color past a blit map
	14	(that is based on the palette) memory. I.e. passing such SDL_Surface
	15	to e.g. an SDL_DisplayFormat() function will result in a buffer overread in
	16	a blit function.
	17
	18	This patch fixes it by validing each pixel's color to be less than the
	19	maximal color number in the palette. A validation failure raises an
	20	error from a SDL_LoadBMP_RW() function.
	21
	22	CVE-2019-7635
	23	https://bugzilla.libsdl.org/show_bug.cgi?id=4498
	24
	25	Signed-off-by: Petr Písař <ppisar@redhat.com>
	26
	27	CVE: CVE-2019-7635
	28	Upstream-Status: Backport
	29	Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
	30
	31	diff -r a936f9bd3e38 -r f1f5878be5db src/video/SDL_bmp.c
	32	--- a/src/video/SDL_bmp.c Mon Jun 10 09:25:05 2019 -0700
	33	+++ b/src/video/SDL_bmp.c Tue Jun 11 06:28:12 2019 -0700
	34	@@ -308,6 +308,12 @@
	35	}
	36	*(bits+i) = (pixel>>shift);
	37	pixel <<= ExpandBMP;
	38	+ if ( bits[i] >= biClrUsed ) {
	39	+ SDL_SetError(
	40	+ "A BMP image contains a pixel with a color out of the palette");
	41	+ was_error = SDL_TRUE;
	42	+ goto done;
	43	+ }
	44	} }
	45	break;
	46
	47	@@ -318,6 +324,16 @@
	48	was_error = SDL_TRUE;
	49	goto done;
	50	}
	51	+ if ( 8 == biBitCount && palette && biClrUsed < (1 << biBitCount ) ) {
	52	+ for ( i=0; i<surface->w; ++i ) {
	53	+ if ( bits[i] >= biClrUsed ) {
	54	+ SDL_SetError(
	55	+ "A BMP image contains a pixel with a color out of the palette");
	56	+ was_error = SDL_TRUE;
	57	+ goto done;
	58	+ }
	59	+ }
	60	+ }
	61	#if SDL_BYTEORDER == SDL_BIG_ENDIAN
	62	/* Byte-swap the pixels if needed. Note that the 24bpp
	63	case has already been taken care of above. */