Sam Lantinga 892c8d5058 Fixed bug 4536 - Heap-Buffer Overflow in SDL_GetRGB pertaining to SDL_pixels.c
Ozkan Sezer

As for the issue: This bmp reports bpp=0, therefore SDL_CalculatePitch()
returns pitch==0, which is then fed to SDL_malloc() (which is malloc())
and malloc(0) returns _something_ which is not NULL but not someting
that we expect..  Then testsprite.c:LoadSprite() accesses the pixels
as *(Uint8*)pixels which valrind reports as:

==15533== Invalid read of size 1
==15533==    at 0x8048C08: LoadSprite (testsprite.c:45)
==15533==    by 0x80492FC: main (testsprite.c:224)
==15533==  Address 0x449e588 is 0 bytes after a block of size 0 alloc'd
==15533==    at 0x40072B2: malloc (vg_replace_malloc.c:270)
==15533==    by 0x4045719: SDL_CreateRGBSurface (SDL_surface.c:126)
==15533==    by 0x40403C1: SDL_LoadBMP_RW (SDL_bmp.c:237)
==15533==    by 0x8048BB2: LoadSprite (testsprite.c:36)
==15533==    by 0x80492FC: main (testsprite.c:224)

Besides, valrind also reports this:
==15533== Conditional jump or move depends on uninitialised value(s)
==15533==    at 0x40403F3: SDL_LoadBMP_RW (SDL_bmp.c:247)
==15533==    by 0x8048BB2: LoadSprite (testsprite.c:36)
==15533==    by 0x80492FC: main (testsprite.c:224)


Easy/quick solution would be early-rejecting a bmp with 0 bpp from SDL_bmp.c:SDL_LoadBMP_RW()
2019-09-03 11:55:20 -07:00
2019-03-16 17:39:15 -07:00
2019-06-17 10:13:28 -07:00
2019-06-17 10:13:28 -07:00
2019-08-04 14:56:02 +03:00
2019-08-08 23:35:02 +03:00
2019-08-23 03:01:10 +03:00
2019-08-03 12:49:50 +03:00
2019-08-30 08:43:13 +02:00
2019-01-04 22:01:14 -08:00
2017-02-16 16:59:07 -05:00
2018-08-21 13:29:21 -07:00
2019-08-04 14:56:02 +03:00
2018-08-21 13:29:21 -07:00
2018-08-21 13:29:21 -07:00
2018-08-21 13:29:21 -07:00
2016-01-12 22:23:53 +01:00

                         Simple DirectMedia Layer

                                  (SDL)

                                Version 2.0

---
https://www.libsdl.org/

Simple DirectMedia Layer is a cross-platform development library designed
to provide low level access to audio, keyboard, mouse, joystick, and graphics
hardware via OpenGL and Direct3D. It is used by video playback software,
emulators, and popular games including Valve's award winning catalog
and many Humble Bundle games.

More extensive documentation is available in the docs directory, starting
with README.md

Enjoy!
	Sam Lantinga				(slouken@libsdl.org)
Description
Simple Directmedia Layer
Readme 92 MiB
Languages
C 56.9%
C++ 36.4%
Objective-C 2.3%
Shell 1.3%
M4 1%
Other 2%