SHA256
1
0
forked from jengelh/SDL2
Dominique Leuenberger 2017-11-11 13:16:53 +00:00 committed by Git OBS Bridge
commit bd90175cd8
9 changed files with 19 additions and 135 deletions

View File

@ -1,49 +0,0 @@
# From: sreeves@suse.com
# CVE-2017-2888. Check for overflow when computing size.
# Based on upstream patch: 81a4950907a01359f2f9390875291eb3951e6c6b
Index: SDL2-2.0.6/include/SDL_stdinc.h
===================================================================
--- SDL2-2.0.6.orig/include/SDL_stdinc.h
+++ SDL2-2.0.6/include/SDL_stdinc.h
@@ -162,6 +162,7 @@ typedef uint16_t Uint16;
/**
* \brief A signed 32-bit integer type.
*/
+#define SDL_MAX_SINT32 ((Sint32)0x7FFFFFFF) /* 2147483647 */
typedef int32_t Sint32;
/**
* \brief An unsigned 32-bit integer type.
Index: SDL2-2.0.6/src/video/SDL_surface.c
===================================================================
--- SDL2-2.0.6.orig/src/video/SDL_surface.c
+++ SDL2-2.0.6/src/video/SDL_surface.c
@@ -26,6 +26,10 @@
#include "SDL_RLEaccel_c.h"
#include "SDL_pixels_c.h"
+/* Check to make sure we can safely check multiplication of surface w and pitch and it won't overflow size_t */
+SDL_COMPILE_TIME_ASSERT(surface_size_assumptions,
+ sizeof(int) == sizeof(Sint32) && sizeof(size_t) >= sizeof(Sint32));
+
/* Public routines */
/*
@@ -80,7 +84,16 @@ SDL_CreateRGBSurfaceWithFormat(Uint32 fl
/* Get the pixels */
if (surface->w && surface->h) {
- surface->pixels = SDL_malloc(surface->h * surface->pitch);
+ /* Assumptions checked in surface_size_assumptions assert above */
+ Sint64 size = ((Sint64)surface->h * surface->pitch);
+ if (size < 0 || size > SDL_MAX_SINT32) {
+ /* Overflow... */
+ SDL_FreeSurface(surface);
+ SDL_OutOfMemory();
+ return NULL;
+ }
+
+ surface->pixels = SDL_malloc((size_t)size);
if (!surface->pixels) {
SDL_FreeSurface(surface);
SDL_OutOfMemory();

View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:03658b5660d16d7b31263a691e058ed37acdab155d68dabbad79998fb552c5df
size 4420311

Binary file not shown.

3
SDL2-2.0.7.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:ee35c74c4313e2eda104b14b1b86f7db84a04eeab9430d56e001cea268bf4d5e
size 4432499

BIN
SDL2-2.0.7.tar.gz.sig Normal file

Binary file not shown.

View File

@ -1,54 +0,0 @@
# https://bugzilla.libsdl.org/show_bug.cgi?id=3466
# commits 5184186d4366 and fbf9b0e3589a
# PATCH-FIX-UPSTREAM SDL2-declaration-after-statement.patch
# backported to fix build on Factory/ppc64, cf. https://bugzilla.libsdl.org/show_bug.cgi?id=3466
#
diff -udpr SDL2-2.0.5.orig/src/video/SDL_blit_N.c SDL2-2.0.5/src/video/SDL_blit_N.c
--- SDL2-2.0.5.orig/src/video/SDL_blit_N.c 2016-10-20 05:56:26.000000000 +0200
+++ SDL2-2.0.5/src/video/SDL_blit_N.c 2016-10-23 09:58:57.319897519 +0200
@@ -118,12 +118,6 @@ calc_swizzle32(const SDL_PixelFormat * s
16, 8, 0, 24,
0, NULL
};
- if (!srcfmt) {
- srcfmt = &default_pixel_format;
- }
- if (!dstfmt) {
- dstfmt = &default_pixel_format;
- }
const vector unsigned char plus = VECUINT8_LITERAL(0x00, 0x00, 0x00, 0x00,
0x04, 0x04, 0x04, 0x04,
0x08, 0x08, 0x08, 0x08,
@@ -131,11 +125,20 @@ calc_swizzle32(const SDL_PixelFormat * s
0x0C);
vector unsigned char vswiz;
vector unsigned int srcvec;
+ Uint32 rmask, gmask, bmask, amask;
+
+ if (!srcfmt) {
+ srcfmt = &default_pixel_format;
+ }
+ if (!dstfmt) {
+ dstfmt = &default_pixel_format;
+ }
+
#define RESHIFT(X) (3 - ((X) >> 3))
- Uint32 rmask = RESHIFT(srcfmt->Rshift) << (dstfmt->Rshift);
- Uint32 gmask = RESHIFT(srcfmt->Gshift) << (dstfmt->Gshift);
- Uint32 bmask = RESHIFT(srcfmt->Bshift) << (dstfmt->Bshift);
- Uint32 amask;
+ rmask = RESHIFT(srcfmt->Rshift) << (dstfmt->Rshift);
+ gmask = RESHIFT(srcfmt->Gshift) << (dstfmt->Gshift);
+ bmask = RESHIFT(srcfmt->Bshift) << (dstfmt->Bshift);
+
/* Use zero for alpha if either surface doesn't have alpha */
if (dstfmt->Amask) {
amask =
@@ -147,6 +150,7 @@ calc_swizzle32(const SDL_PixelFormat * s
0xFFFFFFFF);
}
#undef RESHIFT
+
((unsigned int *) (char *) &srcvec)[0] = (rmask | gmask | bmask | amask);
vswiz = vec_add(plus, (vector unsigned char) vec_splat(srcvec, 0));
return (vswiz);

View File

@ -1,3 +1,18 @@
-------------------------------------------------------------------
Sat Oct 28 21:01:17 UTC 2017 - adam@mizerski.pl
- update to 2.0.7
* Added audio stream conversion functions.
* Added functions to query and set the SDL memory allocation
functions.
* Added locking functions for multi-threaded access to
the joystick and game controller APIs.
* Some functions are now thread-safe.
- removed patches, merged upstream
* dbus.diff
* SDL2-ppc64-declaration-after-statement.patch
* SDL-bnc1062784-check-overflow-xcf-props.patch
------------------------------------------------------------------- -------------------------------------------------------------------
Thu Oct 19 04:00:09 UTC 2017 - sreeves@suse.com Thu Oct 19 04:00:09 UTC 2017 - sreeves@suse.com

View File

@ -18,7 +18,7 @@
Name: SDL2 Name: SDL2
%define lname libSDL2-2_0-0 %define lname libSDL2-2_0-0
Version: 2.0.6 Version: 2.0.7
Release: 0 Release: 0
Summary: Simple DirectMedia Layer Library Summary: Simple DirectMedia Layer Library
License: Zlib License: Zlib
@ -30,9 +30,6 @@ Source: http://libsdl.org/release/%name-%version.tar.gz
Source2: http://libsdl.org/release/%name-%version.tar.gz.sig Source2: http://libsdl.org/release/%name-%version.tar.gz.sig
Source3: %name.keyring Source3: %name.keyring
Source4: baselibs.conf Source4: baselibs.conf
Patch1: dbus.diff
Patch2: %name-ppc64-declaration-after-statement.patch
Patch3: SDL-bnc1062784-check-overflow-xcf-props.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRoot: %{_tmppath}/%{name}-%{version}-build
BuildRequires: cmake BuildRequires: cmake
BuildRequires: dos2unix BuildRequires: dos2unix
@ -106,10 +103,6 @@ library.
%prep %prep
%setup -q %setup -q
%patch -P 1 -P 3 -p1
%ifarch ppc64 ppc64le
%patch -P 2 -p1
%endif
dos2unix WhatsNew.txt dos2unix WhatsNew.txt
dos2unix TODO.txt dos2unix TODO.txt
dos2unix BUGS.txt dos2unix BUGS.txt

View File

@ -1,21 +0,0 @@
References: https://bugzilla.libsdl.org/show_bug.cgi?id=3854
Fix an assertion, triggered by libdbus receiving garbage
from a varargs function in SDL.
---
src/core/linux/SDL_ibus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Index: SDL2-2.0.6/src/core/linux/SDL_ibus.c
===================================================================
--- SDL2-2.0.6.orig/src/core/linux/SDL_ibus.c
+++ SDL2-2.0.6/src/core/linux/SDL_ibus.c
@@ -479,7 +479,7 @@ IBus_SimpleMessage(const char *method)
SDL_DBusContext *dbus = SDL_DBus_GetContext();
if (IBus_CheckConnection(dbus)) {
- SDL_DBus_CallVoidMethodOnConnection(ibus_conn, IBUS_SERVICE, input_ctx_path, IBUS_INPUT_INTERFACE, method);
+ SDL_DBus_CallVoidMethodOnConnection(ibus_conn, IBUS_SERVICE, input_ctx_path, IBUS_INPUT_INTERFACE, method, DBUS_TYPE_INVALID);
}
}