Please sign in to comment.
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pi…
…xels.c Petr Pisar The reproducer has these data in BITMAPINFOHEADER: biSize = 40 biBitCount = 8 biClrUsed = 131075 SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount.
- Loading branch information
Showing with 4 additions and 0 deletions.
- +4 −0 src/video/SDL_bmp.c