sdl2_frt/src
Sam Lantinga fb835f9e3b Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor
manuel.montezelo

Original bug report (note that it was against 2.0.0, it might have been fixed in between):  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733015

--------------------------------------------------------
Package: libsdl2-2.0-0
Version: 2.0.0+dfsg1-3
Severity: normal
Tags: patch

I have occasional crashes here caused by the X11 backend of SDL2. It seems to
be caused by the X11_Pending function trying to add a high number (> 1024)
file descriptor to a fd_set before doing a select on it to avoid busy waiting
on X11 events. This causes a buffer overflow because the file descriptor is
larger (or equal) than the limit FD_SETSIZE.

Attached is a possible workaround patch.

Please also keep in mind that fd_set are also used in following files which
may have similar problems.

src/audio/bsd/SDL_bsdaudio.c
src/audio/paudio/SDL_paudio.c
src/audio/qsa/SDL_qsa_audio.c
src/audio/sun/SDL_sunaudio.c
src/joystick/linux/SDL_sysjoystick.c


--------------------------------------------------------

On Tuesday 24 December 2013 00:43:13 Sven Eckelmann wrote:
> I have occasional crashes here caused by the X11 backend of SDL2. It seems
> to be caused by the X11_Pending function trying to add a high number (>
> 1024) file descriptor to a fd_set before doing a select on it to avoid busy
> waiting on X11 events. This causes a buffer overflow because the file
> descriptor is larger (or equal) than the limit FD_SETSIZE.


I personally experienced this problem while hacking on the python bindings
package for SDL2 [1] (while doing make runtest). But it easier to reproduce in
a smaller, synthetic testcase.
2017-08-14 20:22:19 -07:00
..
atomic atomic: Patched to compile on Android. 2017-04-13 15:28:56 -04:00
audio Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor 2017-08-14 20:22:19 -07:00
core Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor 2017-08-14 20:22:19 -07:00
cpuinfo Fixed compile error with gcc -std=c99 2017-03-06 21:25:06 -08:00
dynapi Fixed bug 2441 - SDL_DuplicateSurface 2017-08-14 13:37:14 -07:00
events Fixed Windows build due to an implicit memcpy generated by the optimizer 2017-08-14 16:09:44 -07:00
file Fixed compiler warnings on Visual Studio 2013 2017-08-12 00:04:46 -07:00
filesystem Fixed bug 3639 - SDL_GetPrefPath returns a path with two consecutive slashes on Unix if org is omitted 2017-08-11 11:32:00 -07:00
haptic Fixed bug 3191 - haptic system on android? 2017-08-12 08:15:09 -07:00
joystick Fixed bug 3745 - specify SDLCALL as the calling convention for API callbacks 2017-08-14 06:28:21 -07:00
libm Updated copyright for 2017 2017-01-01 18:33:28 -08:00
loadso Updated copyright for 2017 2017-01-01 18:33:28 -08:00
main Fixed bug 2812 - Make libSDL2main.a usable on Android via a dummy symbol 2017-08-13 18:12:06 -07:00
power power: whoops, that should be "==" not "!=". 2017-07-03 16:45:12 -04:00
render Fixed compiler warnings 2017-08-14 20:07:30 -07:00
stdlib Added SDL_wcscmp() 2017-08-13 20:37:49 -07:00
test Added test debug logs for additional event types 2017-08-12 20:21:34 -07:00
thread Fixed bug 3745 - specify SDLCALL as the calling convention for API callbacks 2017-08-14 06:28:21 -07:00
timer Fixed bug 3745 - specify SDLCALL as the calling convention for API callbacks 2017-08-14 06:28:21 -07:00
video Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor 2017-08-14 20:22:19 -07:00
SDL_assert_c.h Updated copyright for 2017 2017-01-01 18:33:28 -08:00
SDL_assert.c Fixed bug 3744 - missing SDLCALL in several functions 2017-08-13 21:06:52 -07:00
SDL_dataqueue.c Updated copyright for 2017 2017-01-01 18:33:28 -08:00
SDL_dataqueue.h Updated copyright for 2017 2017-01-01 18:33:28 -08:00
SDL_error_c.h Updated copyright for 2017 2017-01-01 18:33:28 -08:00
SDL_error.c Fixed bug 3696 - SDL_ShowMessageBox displays different error from intended 2017-07-10 17:16:12 -07:00
SDL_hints.c Updated copyright for 2017 2017-01-01 18:33:28 -08:00
SDL_internal.h Some patches to make SDL compile with armcc (ARM's C compiler). 2017-03-02 13:33:04 -05:00
SDL_log.c Fixed bug 3745 - specify SDLCALL as the calling convention for API callbacks 2017-08-14 06:28:21 -07:00
SDL.c Backing out broken change from previous commit. 2017-04-01 00:46:42 -04:00