commit 0d5aa3837b4604204e9bc312633d37ec5d1d6321
author Sylvain Becker <sylvain.becker@gmail.com> Fri Jan 29 12:04:48 2021 +0100
committer Sylvain Becker <sylvain.becker@gmail.com> Fri Jan 29 12:04:48 2021 +0100
tree a364d65a90a722dcf1a272de2a4375632e099815
parent 48a6e210f894a6be39768c92efba848b1398c136

Add checks for maximun scaling size (see bug #5510)

src/video/SDL_stretch.c

diff --git a/src/video/SDL_stretch.c b/src/video/SDL_stretch.c
index eec1cc6..8b5512f 100644
--- a/src/video/SDL_stretch.c
+++ b/src/video/SDL_stretch.c
@@ -94,6 +94,11 @@
         return 0;
     }
 
+    if (srcrect->w > SDL_MAX_UINT16 || srcrect->h > SDL_MAX_UINT16 ||
+        dstrect->w > SDL_MAX_UINT16 || dstrect->h > SDL_MAX_UINT16) {
+        return SDL_SetError("Too large size for scaling");
+    }
+
     /* Lock the destination if it's in hardware */
     dst_locked = 0;
     if (SDL_MUSTLOCK(dst)) {

src/video/SDL_surface.c

diff --git a/src/video/SDL_surface.c b/src/video/SDL_surface.c
index 2550f92..0ff6f2a 100644
--- a/src/video/SDL_surface.c
+++ b/src/video/SDL_surface.c
@@ -931,6 +931,11 @@
         SDL_COPY_COLORKEY
     );
 
+    if (srcrect->w > SDL_MAX_UINT16 || srcrect->h > SDL_MAX_UINT16 ||
+        dstrect->w > SDL_MAX_UINT16 || dstrect->h > SDL_MAX_UINT16) {
+        return SDL_SetError("Too large size for scaling");
+    }
+
     if (!(src->map->info.flags & SDL_COPY_NEAREST)) {
         src->map->info.flags |= SDL_COPY_NEAREST;
         SDL_InvalidateMap(src->map);