-
Show log
Commit
-
Hash : fb835f9e
Author :
Date : 2017-08-14T20:22:19
Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor manuel.montezelo Original bug report (note that it was against 2.0.0, it might have been fixed in between): http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733015 -------------------------------------------------------- Package: libsdl2-2.0-0 Version: 2.0.0+dfsg1-3 Severity: normal Tags: patch I have occasional crashes here caused by the X11 backend of SDL2. It seems to be caused by the X11_Pending function trying to add a high number (> 1024) file descriptor to a fd_set before doing a select on it to avoid busy waiting on X11 events. This causes a buffer overflow because the file descriptor is larger (or equal) than the limit FD_SETSIZE. Attached is a possible workaround patch. Please also keep in mind that fd_set are also used in following files which may have similar problems. src/audio/bsd/SDL_bsdaudio.c src/audio/paudio/SDL_paudio.c src/audio/qsa/SDL_qsa_audio.c src/audio/sun/SDL_sunaudio.c src/joystick/linux/SDL_sysjoystick.c -------------------------------------------------------- On Tuesday 24 December 2013 00:43:13 Sven Eckelmann wrote: > I have occasional crashes here caused by the X11 backend of SDL2. It seems > to be caused by the X11_Pending function trying to add a high number (> > 1024) file descriptor to a fd_set before doing a select on it to avoid busy > waiting on X11 events. This causes a buffer overflow because the file > descriptor is larger (or equal) than the limit FD_SETSIZE. I personally experienced this problem while hacking on the python bindings package for SDL2 [1] (while doing make runtest). But it easier to reproduce in a smaller, synthetic testcase.
-
Files
- SDL.h
- SDL_assert.h
- SDL_atomic.h
- SDL_audio.h
- SDL_bits.h
- SDL_blendmode.h
- SDL_clipboard.h
- SDL_config.h
- SDL_config.h.cmake
- SDL_config.h.in
- SDL_config_android.h
- SDL_config_iphoneos.h
- SDL_config_macosx.h
- SDL_config_minimal.h
- SDL_config_pandora.h
- SDL_config_psp.h
- SDL_config_windows.h
- SDL_config_winrt.h
- SDL_config_wiz.h
- SDL_copying.h
- SDL_cpuinfo.h
- SDL_egl.h
- SDL_endian.h
- SDL_error.h
- SDL_events.h
- SDL_filesystem.h
- SDL_gamecontroller.h
- SDL_gesture.h
- SDL_haptic.h
- SDL_hints.h
- SDL_joystick.h
- SDL_keyboard.h
- SDL_keycode.h
- SDL_loadso.h
- SDL_log.h
- SDL_main.h
- SDL_messagebox.h
- SDL_mouse.h
- SDL_mutex.h
- SDL_name.h
- SDL_opengl.h
- SDL_opengl_glext.h
- SDL_opengles.h
- SDL_opengles2.h
- SDL_opengles2_gl2.h
- SDL_opengles2_gl2ext.h
- SDL_opengles2_gl2platform.h
- SDL_opengles2_khrplatform.h
- SDL_pixels.h
- SDL_platform.h
- SDL_power.h
- SDL_quit.h
- SDL_rect.h
- SDL_render.h
- SDL_revision.h
- SDL_rwops.h
- SDL_scancode.h
- SDL_shape.h
- SDL_stdinc.h
- SDL_surface.h
- SDL_system.h
- SDL_syswm.h
- SDL_test.h
- SDL_test_assert.h
- SDL_test_common.h
- SDL_test_compare.h
- SDL_test_crc32.h
- SDL_test_font.h
- SDL_test_fuzzer.h
- SDL_test_harness.h
- SDL_test_images.h
- SDL_test_log.h
- SDL_test_md5.h
- SDL_test_random.h
- SDL_thread.h
- SDL_timer.h
- SDL_touch.h
- SDL_types.h
- SDL_version.h
- SDL_video.h
- begin_code.h
- close_code.h
-
Properties
-
Git HTTP https://git.kmx.io/kc3-lang/SDL.git Git SSH git@git.kmx.io:kc3-lang/SDL.git Public access ? public Description Users
Tags
