aboutsummaryrefslogtreecommitdiffstats
path: root/main/sdl2_image/CVE-2017-12122.patch
blob: 9c2f33b1707df30d2c190c2ca89a966b169275e0 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
diff -r 3e1ebbbaba54 -r 16772bbb1b09 IMG_lbm.c
--- a/IMG_lbm.c	Wed Jan 24 01:43:46 2018 -0500
+++ b/IMG_lbm.c	Wed Jan 24 01:44:36 2018 -0500
@@ -245,7 +245,7 @@
         goto done;
     }
 
-    if ( ( Image = SDL_CreateRGBSurface( SDL_SWSURFACE, width, bmhd.h, (bmhd.planes==24 || flagHAM==1)?24:8, 0, 0, 0, 0 ) ) == NULL )
+    if ( ( Image = SDL_CreateRGBSurface( SDL_SWSURFACE, width, bmhd.h, (nbplanes==24 || flagHAM==1)?24:8, 0, 0, 0, 0 ) ) == NULL )
        goto done;
 
     if ( bmhd.mask & 2 )               /* There is a transparent color */
@@ -272,7 +272,7 @@
         /* The 32 last colors are the same but divided by 2 */
         /* Some Amiga pictures save 64 colors with 32 last wrong colors, */
         /* they shouldn't !, and here we overwrite these 32 bad colors. */
-        if ( (nbcolors==32 || flagEHB ) && (1<<bmhd.planes)==64 )
+        if ( (nbcolors==32 || flagEHB ) && (1<<nbplanes)==64 )
         {
             nbcolors = 64;
             ptr = &colormap[0];
@@ -286,8 +286,8 @@
 
         /* If nbcolors < 2^nbplanes, repeat the colormap */
         /* This happens when pictures have a stencil mask */
-        if ( nbrcolorsfinal > (1<<bmhd.planes) ) {
-            nbrcolorsfinal = (1<<bmhd.planes);
+        if ( nbrcolorsfinal > (1<<nbplanes) ) {
+            nbrcolorsfinal = (1<<nbplanes);
         }
         for ( i=nbcolors; i < (Uint32)nbrcolorsfinal; i++ )
         {


diff -r 16772bbb1b09 -r 97f7f01e0665 IMG_lbm.c
--- a/IMG_lbm.c	Wed Jan 24 01:44:36 2018 -0500
+++ b/IMG_lbm.c	Wed Jan 24 01:45:04 2018 -0500
@@ -233,6 +233,12 @@
         nbplanes = 1;
     }
 
+    if ((nbplanes != 1) && (nbplanes != 4) && (nbplanes != 8) && (nbplanes != 24))
+    {
+        error="unsupported number of color planes";
+        goto done;
+    }
+
     stencil = (bmhd.mask & 1);   /* There is a mask ( 'stencil' ) */
 
     /* Allocate memory for a temporary buffer ( used for