Commit ea4c4cfc28e19ec1fc7ae69a70f70943f7933b38

Sam Lantinga 2019-02-18T07:50:33

Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pixels.c Petr Pisar The reproducer has these data in BITMAPINFOHEADER: biSize = 40 biBitCount = 8 biClrUsed = 131075 SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c
index 908b77c..5974414 100644
--- a/src/video/SDL_bmp.c
+++ b/src/video/SDL_bmp.c
@@ -313,6 +313,10 @@ SDL_LoadBMP_RW(SDL_RWops * src, int freesrc)
         SDL_assert(biBitCount <= 8);
         if (biClrUsed == 0) {
             biClrUsed = 1 << biBitCount;
+		} else if (biClrUsed > (1 << biBitCount)) {
+			SDL_SetError("BMP file has an invalid number of colors");
+			was_error = SDL_TRUE;
+			goto done;
         }
         if ((int) biClrUsed > palette->ncolors) {
             SDL_Color *colors;