From b3f861c5f004846cc8204f1ebd240db144c93e81 Mon Sep 17 00:00:00 2001 From: xinyingchao Date: Tue, 15 Mar 2022 17:27:36 +0800 Subject: [PATCH] Fix CVE-2021-33657 --- SDL2.spec | 9 ++++++++- backport-CVE-2021-33657.patch | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2021-33657.patch diff --git a/SDL2.spec b/SDL2.spec index a1ece90..7bef884 100644 --- a/SDL2.spec +++ b/SDL2.spec @@ -1,6 +1,6 @@ Name: SDL2 Version: 2.0.12 -Release: 1 +Release: 2 Summary: Cross-platform multimedia library License: zlib and MIT URL: http://www.libsdl.org/ @@ -8,6 +8,7 @@ Source0: http://www.libsdl.org/release/%{name}-%{version}.tar.gz Source1: SDL_config.h Patch0000: multilib.patch Patch0001: SDL2-2.0.9-khrplatform.patch +Patch6000: backport-CVE-2021-33657.patch BuildRequires: alsa-lib-devel audiofile-devel mesa-libGL-devel BuildRequires: mesa-libGLU-devel mesa-libEGL-devel libglvnd-devel @@ -89,6 +90,12 @@ rm -vf %{buildroot}%{_libdir}/*.la %{_libdir}/lib*.a %changelog +* Tue Mar 15 2022 yuanxin - 2.0.12-2 +- Type:CVE +- ID:NA +- SUG:NA +- DESC:Fix CVE-2021-33657 + * Mon Nov 16 2020 Zhiyi Weng - 2.0.12-1 - Update to 2.0.12 diff --git a/backport-CVE-2021-33657.patch b/backport-CVE-2021-33657.patch new file mode 100644 index 0000000..31c0c52 --- /dev/null +++ b/backport-CVE-2021-33657.patch @@ -0,0 +1,33 @@ +From 8c91cf7dba5193f5ce12d06db1336515851c9ee9 Mon Sep 17 00:00:00 2001 +From: Sam Lantinga +Date: Tue, 30 Nov 2021 12:36:46 -0800 +Subject: [PATCH] Always create a full 256-entry map in case color values are + out of range + +Fixes https://github.com/libsdl-org/SDL/issues/5042 +--- + src/video/SDL_pixels.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/video/SDL_pixels.c b/src/video/SDL_pixels.c +index ac04533c5d5..9bb02f771d0 100644 +--- a/src/video/SDL_pixels.c ++++ b/src/video/SDL_pixels.c +@@ -947,7 +947,7 @@ Map1to1(SDL_Palette * src, SDL_Palette * dst, int *identical) + } + *identical = 0; + } +- map = (Uint8 *) SDL_malloc(src->ncolors); ++ map = (Uint8 *) SDL_calloc(256, sizeof(Uint8)); + if (map == NULL) { + SDL_OutOfMemory(); + return (NULL); +@@ -971,7 +971,7 @@ Map1toN(SDL_PixelFormat * src, Uint8 Rmod, Uint8 Gmod, Uint8 Bmod, Uint8 Amod, + SDL_Palette *pal = src->palette; + + bpp = ((dst->BytesPerPixel == 3) ? 4 : dst->BytesPerPixel); +- map = (Uint8 *) SDL_malloc(pal->ncolors * bpp); ++ map = (Uint8 *) SDL_calloc(256, bpp); + if (map == NULL) { + SDL_OutOfMemory(); + return (NULL); -- Gitee