Bug 1920458 (CVE-2020-14410) - CVE-2020-14410 SDL2: Heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file
Summary: CVE-2020-14410 SDL2: Heap-based buffer over-read in Blit_3or4_to_3or4__invers...
Keywords:
Status: NEW
Alias: CVE-2020-14410
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1921876 1920459 1921873 1921874 1921877
Blocks: 1920460
TreeView+ depends on / blocked
 
Reported: 2021-01-26 11:10 UTC by Marian Rehak
Modified: 2022-08-30 12:14 UTC (History)
8 users (show)

Fixed In Version: SDL 2.0.14
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Marian Rehak 2021-01-26 11:10:38 UTC
SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file.

Reference:

https://bugzilla.libsdl.org/show_bug.cgi?id=5200

Comment 1 Marian Rehak 2021-01-26 11:11:31 UTC
Created SDL tracking bugs for this issue:

Affects: fedora-all [bug 1920459]

Comment 2 Petr Pisar 2021-01-26 12:47:49 UTC
Didn't you mistaken SDL with SDL2?

The linked patch is for SDL2 and it makes sure that calculating int surface->pitch in SDL_CreateRGBSurfaceWithFormat() does not overflow and thus that any subsequent memory allocation and access based on the pitch and surface->width and surface->height are correct.

SDL we have in Fedora and RHEL and upstream has is already hardened: SDL_CreateRGBSurface() makes sure that width and height fits into unsigned 16-bit integer and SDL_CalculatePitch() makes sure that the pitch computation also fits into unsigned 16-bit integer (surface-pitch is Uint16 type there). The multiplication at SDL_malloc(surface->h*surface->pitch) in SDL_CreateRGBSurface() cannot overflow because the argument has size_t type which is not shorter than unsigned 32-bit on any Fedora and RHEL supported platform. Therefore I think SDL is not vulnerable.

Do you have a counter example? Or at least reproducer for the original SDL2 bug?

Comment 3 Todd Cullum 2021-01-28 18:35:08 UTC
Upstream patch: https://hg.libsdl.org/SDL/rev/3f9b4e92c1d9

Comment 4 Todd Cullum 2021-01-28 18:37:49 UTC
Created SDL2 tracking bugs for this issue:

Affects: fedora-all [bug 1921873]


Created mingw-SDL2 tracking bugs for this issue:

Affects: fedora-all [bug 1921874]

Comment 7 Todd Cullum 2021-01-29 19:32:07 UTC
Statement:

SDL as shipped in Red Hat Enterprise Linux 6, 7, and 8 is not affected as the vulnerable code exists in SDL2; SDL is already hardened for this flaw.


Note You need to log in before you can comment on or make changes to this bug.