Ryujinx-SDL/src
Sam Lantinga 8bc59f87ec Fixed CVE-2019-7635 and bug 4498 - Heap-Buffer Overflow in Blit1to4 pertaining to SDL_blit_1.c
Petr Pisar

The root cause is that the POC BMP file declares 3 colors used and 4 bpp palette, but pixel at line 28 and column 1 (counted from 0) has color number 3. Then when the image loaded into a surface is passed to SDL_DisplayFormat(), in order to convert it to a video format, a used bliting function looks up a color number 3 in a 3-element long color bliting map. (The map obviously has the same number entries as the surface format has colors.)

Proper fix should refuse broken BMP images that have a pixel with a color index higher than declared number of "used" colors. Possibly more advanced fix could try to relocate the out-of-range color index into a vacant index (if such exists).
2019-03-16 18:34:33 -07:00
..
atomic Updated copyright for 2019 2019-01-04 22:01:14 -08:00
audio Android/openslES: fix warnings, comment out un-used interface 2019-02-05 15:14:15 +01:00
core Android: check SDL is initialized before sending the event 2019-03-13 09:39:30 +01:00
cpuinfo Updated copyright for 2019 2019-01-04 22:01:14 -08:00
dynapi Updated copyright for 2019 2019-01-04 22:01:14 -08:00
events Fix compiler warnings. 2019-03-16 00:08:19 -04:00
file Updated copyright for 2019 2019-01-04 22:01:14 -08:00
filesystem Updated copyright for 2019 2019-01-04 22:01:14 -08:00
haptic Updated copyright for 2019 2019-01-04 22:01:14 -08:00
hidapi HIDAPI: fix bug that caused non-HID class parts of composite devices to have windows HID functions called on them. 2019-03-12 14:44:12 -07:00
joystick Fix polling left trigger reporting right trigger's values. 2019-03-16 18:12:26 -07:00
libm Updated copyright for 2019 2019-01-04 22:01:14 -08:00
loadso Updated copyright for 2019 2019-01-04 22:01:14 -08:00
main Updated copyright for 2019 2019-01-04 22:01:14 -08:00
power Updated copyright for 2019 2019-01-04 22:01:14 -08:00
render Fixed bug 4542 - Image flipped vertically when rendering on texture 2019-03-12 07:59:53 +01:00
sensor Updated copyright for 2019 2019-01-04 22:01:14 -08:00
stdlib Updated copyright for 2019 2019-01-04 22:01:14 -08:00
test Updated copyright for 2019 2019-01-04 22:01:14 -08:00
thread Updated copyright for 2019 2019-01-04 22:01:14 -08:00
timer Updated copyright for 2019 2019-01-04 22:01:14 -08:00
video Fixed CVE-2019-7635 and bug 4498 - Heap-Buffer Overflow in Blit1to4 pertaining to SDL_blit_1.c 2019-03-16 18:34:33 -07:00
SDL_assert_c.h Updated copyright for 2019 2019-01-04 22:01:14 -08:00
SDL_assert.c Emscripten: use UTF8ToString instead of Pointer_stringify 2019-01-29 12:19:03 +00:00
SDL_dataqueue.c Updated copyright for 2019 2019-01-04 22:01:14 -08:00
SDL_dataqueue.h Updated copyright for 2019 2019-01-04 22:01:14 -08:00
SDL_error_c.h Updated copyright for 2019 2019-01-04 22:01:14 -08:00
SDL_error.c Fix DirectInput error codes being lost 2019-03-16 18:11:09 -07:00
SDL_hints.c Updated copyright for 2019 2019-01-04 22:01:14 -08:00
SDL_internal.h Updated copyright for 2019 2019-01-04 22:01:14 -08:00
SDL_log.c Updated copyright for 2019 2019-01-04 22:01:14 -08:00
SDL.c events: Make debug logging of the event queue a hint instead of an #ifdef. 2019-03-15 14:08:30 -04:00