File sdl2-surface-pitch-overflow.patch of Package SDL2

Overview Repositories Revisions Requests Users Attributes Meta

File sdl2-surface-pitch-overflow.patch of Package SDL2 (Revision 106d0b1d1a5bd719309705b2adb27316)

Currently displaying revision 106d0b1d1a5bd719309705b2adb27316 , Show latest

changeset:   13915:3f9b4e92c1d9
user:        Sam Lantinga <slouken@libsdl.org>
date:        Wed Jun 17 08:44:45 2020 -0700
summary:     Fixed overflow in surface pitch calculation

Backported by Mike Gorse <mgorse@suse.com>

diff -urp SDL2-2.0.8.orig/src/video/SDL_surface.c SDL2-2.0.8/src/video/SDL_surface.c
--- SDL2-2.0.8.orig/src/video/SDL_surface.c	2018-03-01 10:34:42.000000000 -0600
+++ SDL2-2.0.8/src/video/SDL_surface.c	2022-01-11 15:05:56.679255675 -0600
@@ -28,34 +28,26 @@
 #include "SDL_yuv_c.h"
 
 
-/* Check to make sure we can safely check multiplication of surface w and pitch and it won't overflow size_t */
-SDL_COMPILE_TIME_ASSERT(surface_size_assumptions,
-    sizeof(int) == sizeof(Sint32) && sizeof(size_t) >= sizeof(Sint32));
+/* Check to make sure we can safely check multiplication of surface w and pitch and it won't overflow Sint64 */
+SDL_COMPILE_TIME_ASSERT(surface_size_assumptions, sizeof(int) == sizeof(Sint32));
 
 /* Public routines */
 
 /*
  * Calculate the pad-aligned scanline width of a surface
  */
-int
+static Sint64
 SDL_CalculatePitch(Uint32 format, int width)
 {
-    int pitch;
+    Sint64 pitch;
 
-    /* Surface should be 4-byte aligned for speed */
-    pitch = width * SDL_BYTESPERPIXEL(format);
-    switch (SDL_BITSPERPIXEL(format)) {
-    case 1:
-        pitch = (pitch + 7) / 8;
-        break;
-    case 4:
-        pitch = (pitch + 1) / 2;
-        break;
-    default:
-        break;
-    }
-    pitch = (pitch + 3) & ~3;   /* 4-byte aligning */
-    return pitch;
+     if (SDL_ISPIXELFORMAT_FOURCC(format) || SDL_BITSPERPIXEL(format) >= 8) {
+        pitch = ((Sint64)width * SDL_BYTESPERPIXEL(format));
+     } else {
+        pitch = (((Sint64)width * SDL_BITSPERPIXEL(format)) + 7) / 8;
+     }
+     pitch = (pitch + 3) & ~3;   /* 4-byte aligning for speed */
+     return pitch;
 }
 
 /*
@@ -66,11 +58,19 @@ SDL_Surface *
 SDL_CreateRGBSurfaceWithFormat(Uint32 flags, int width, int height, int depth,
                                Uint32 format)
 {
+    Sint64 pitch;
     SDL_Surface *surface;
 
     /* The flags are no longer used, make the compiler happy */
     (void)flags;
 
+    pitch = SDL_CalculatePitch(format, width);
+    if (pitch < 0 || pitch > SDL_MAX_SINT32) {
+        /* Overflow... */
+        SDL_OutOfMemory();
+        return NULL;
+    }
+
     /* Allocate the surface */
     surface = (SDL_Surface *) SDL_calloc(1, sizeof(*surface));
     if (surface == NULL) {
@@ -85,7 +85,7 @@ SDL_CreateRGBSurfaceWithFormat(Uint32 fl
     }
     surface->w = width;
     surface->h = height;
-    surface->pitch = SDL_CalculatePitch(format, width);
+    surface->pitch = (int)pitch;
     SDL_SetClipRect(surface, NULL);
 
     if (SDL_ISPIXELFORMAT_INDEXED(surface->format->format)) {

Places

File sdl2-surface-pitch-overflow.patch of Package SDL2 (Revision 106d0b1d1a5bd719309705b2adb27316)

Places