tree f7a01a33bc5eb3a72ccf6f67edbb0ffc585d8277
parent ee94bad7f8608549ca58ea69a0e24aa98c570048
author Sam Lantinga <slouken@libsdl.org> 1550505033 -0800
committer Sam Lantinga <slouken@libsdl.org> 1550505033 -0800

Fixed bug 4500 - Heap-Buffer Overflow in Map1toN pertaining to SDL_pixels.c

Petr Pisar

The reproducer has these data in BITMAPINFOHEADER:

biSize = 40
biBitCount = 8
biClrUsed = 131075

SDL_LoadBMP_RW() function passes biBitCount as a color depth to SDL_CreateRGBSurface(), thus 256-color pallete is allocated. But then biClrUsed colors are read from a file and stored into the palette. SDL_LoadBMP_RW should report an error if biClrUsed is greater than 2^biBitCount.