From ea4c4cfc28e19ec1fc7ae69a70f70943f7933b38 Mon Sep 17 00:00:00 2001 From: Sam Lantinga Date: Mon, 18 Feb 2019 07:50:33 -0800 Subject: [PATCH] Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pixels.c Petr Pisar The reproducer has these data in BITMAPINFOHEADER: biSize = 40 biBitCount = 8 biClrUsed = 131075 SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount. --- src/video/SDL_bmp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c index 908b77c56..59744146e 100644 --- a/src/video/SDL_bmp.c +++ b/src/video/SDL_bmp.c @@ -313,6 +313,10 @@ SDL_LoadBMP_RW(SDL_RWops * src, int freesrc) SDL_assert(biBitCount <= 8); if (biClrUsed == 0) { biClrUsed = 1 << biBitCount; + } else if (biClrUsed > (1 << biBitCount)) { + SDL_SetError("BMP file has an invalid number of colors"); + was_error = SDL_TRUE; + goto done; } if ((int) biClrUsed > palette->ncolors) { SDL_Color *colors;