Received: by mail.netbsd.org (Postfix, from userid 605) id 1C7AF84DFF; Fri, 15 May 2020 16:54:44 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 98D5084D72 for ; Fri, 15 May 2020 16:54:43 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id N8hHzOruJunt for ; Fri, 15 May 2020 16:54:43 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.netbsd.org [199.233.217.197]) by mail.netbsd.org (Postfix) with ESMTP id CFE9984D65 for ; Fri, 15 May 2020 16:54:42 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id C9F5AFB27; Fri, 15 May 2020 16:54:42 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1589561682120390" MIME-Version: 1.0 Date: Fri, 15 May 2020 16:54:42 +0000 From: "Benny Siegert" Subject: CVS commit: [pkgsrc-2020Q1] pkgsrc/devel/SDL To: pkgsrc-changes@NetBSD.org Reply-To: bsiegert@netbsd.org X-Mailer: log_accum Message-Id: <20200515165442.C9F5AFB27@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1589561682120390 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: bsiegert Date: Fri May 15 16:54:42 UTC 2020 Modified Files: pkgsrc/devel/SDL [pkgsrc-2020Q1]: Makefile distinfo pkgsrc/devel/SDL/patches [pkgsrc-2020Q1]: patch-src_video_SDL__bmp.c Log Message: Pullup ticket #6197 - requested by nia devel/SDL: security fix Revisions pulled up: - devel/SDL/Makefile 1.139 - devel/SDL/distinfo 1.83 - devel/SDL/patches/patch-src_video_SDL__bmp.c 1.2 --- Module Name: pkgsrc Committed By: nia Date: Thu May 14 14:44:17 UTC 2020 Modified Files: pkgsrc/devel/SDL: Makefile distinfo pkgsrc/devel/SDL/patches: patch-src_video_SDL__bmp.c Log Message: SDL: fix CVE-2019-13616 bump PKGREVISION To generate a diff of this commit: cvs rdiff -u -r1.138 -r1.138.2.1 pkgsrc/devel/SDL/Makefile cvs rdiff -u -r1.82 -r1.82.4.1 pkgsrc/devel/SDL/distinfo cvs rdiff -u -r1.1 -r1.1.6.1 \ pkgsrc/devel/SDL/patches/patch-src_video_SDL__bmp.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1589561682120390 Content-Disposition: inline Content-Length: 4215 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/devel/SDL/Makefile diff -u pkgsrc/devel/SDL/Makefile:1.138 pkgsrc/devel/SDL/Makefile:1.138.2.1 --- pkgsrc/devel/SDL/Makefile:1.138 Sun Mar 8 16:49:09 2020 +++ pkgsrc/devel/SDL/Makefile Fri May 15 16:54:42 2020 @@ -1,7 +1,7 @@ -# $NetBSD: Makefile,v 1.138 2020/03/08 16:49:09 wiz Exp $ +# $NetBSD: Makefile,v 1.138.2.1 2020/05/15 16:54:42 bsiegert Exp $ DISTNAME= SDL-1.2.15 -PKGREVISION= 30 +PKGREVISION= 31 CATEGORIES= devel games MASTER_SITES= http://www.libsdl.org/release/ Index: pkgsrc/devel/SDL/distinfo diff -u pkgsrc/devel/SDL/distinfo:1.82 pkgsrc/devel/SDL/distinfo:1.82.4.1 --- pkgsrc/devel/SDL/distinfo:1.82 Wed Jul 24 14:08:23 2019 +++ pkgsrc/devel/SDL/distinfo Fri May 15 16:54:42 2020 @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.82 2019/07/24 14:08:23 micha Exp $ +$NetBSD: distinfo,v 1.82.4.1 2020/05/15 16:54:42 bsiegert Exp $ SHA1 (SDL-1.2.15.tar.gz) = 0c5f193ced810b0d7ce3ab06d808cbb5eef03a2c RMD160 (SDL-1.2.15.tar.gz) = d4802a090cb4a24eeb0c8ce5690802f596d394c3 @@ -11,7 +11,7 @@ SHA1 (patch-src_audio_bsd_SDL__bsdaudio. SHA1 (patch-src_audio_dma_SDL__dmaaudio.c) = cede64d04e8872b11851bfcacbc99059df973881 SHA1 (patch-src_audio_sun_SDL__sunaudio.c) = 4b492b40d39e6444037dfda55766e4a149cc6c30 SHA1 (patch-src_joystick_bsd_SDL__sysjoystick.c) = a20608d6a4cc8f2c8f5fb2d77a572f373178151b -SHA1 (patch-src_video_SDL__bmp.c) = 87b14ee02315703479ce522299ffe8d9e83d7e06 +SHA1 (patch-src_video_SDL__bmp.c) = 89252aa0de90a80cb7fa1c0bf6a7e0e73973ff83 SHA1 (patch-src_video_SDL__pixels.c) = e4c1feeda33cdd5e891ff203c573c5f578d17368 SHA1 (patch-src_video_nanox_SDL__nxvideo.c) = 653ff4358d62f7093f646fba5ddae2921876144c SHA1 (patch-src_video_quartz_SDL__QuartzVideo.h) = 19d952bade06dbd646e94f42139c38436969b1a8 Index: pkgsrc/devel/SDL/patches/patch-src_video_SDL__bmp.c diff -u pkgsrc/devel/SDL/patches/patch-src_video_SDL__bmp.c:1.1 pkgsrc/devel/SDL/patches/patch-src_video_SDL__bmp.c:1.1.6.1 --- pkgsrc/devel/SDL/patches/patch-src_video_SDL__bmp.c:1.1 Sun Jul 21 11:14:38 2019 +++ pkgsrc/devel/SDL/patches/patch-src_video_SDL__bmp.c Fri May 15 16:54:42 2020 @@ -1,4 +1,4 @@ -$NetBSD: patch-src_video_SDL__bmp.c,v 1.1 2019/07/21 11:14:38 nia Exp $ +$NetBSD: patch-src_video_SDL__bmp.c,v 1.1.6.1 2020/05/15 16:54:42 bsiegert Exp $ CVE-2019-7635: Reject BMP images with pixel colors out the palette From upstream hg 12831:f1f5878be5db @@ -6,12 +6,27 @@ From upstream hg 12831:f1f5878be5db CVE-2019-7636, CVE-2019-7638 From upstream hg 12612:07c39cbbeacf +CVE-2019-13616: validate image size when loading BMP files +From upstream hg 12960:ad1bbfbca760 + Reject 2, 3, 5, 6, 7-bpp BMP images From upstreah hg 12646:4646533663ae --- src/video/SDL_bmp.c.orig 2012-01-19 06:30:06.000000000 +0000 +++ src/video/SDL_bmp.c -@@ -163,6 +163,14 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops +@@ -143,6 +143,11 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops + (void) biYPelsPerMeter; + (void) biClrImportant; + ++ if (biWidth <= 0 || biHeight == 0) { ++ SDL_SetError("BMP file with bad dimensions (%dx%d)", biWidth, biHeight); ++ was_error = SDL_TRUE; ++ goto done; ++ } + if (biHeight < 0) { + topDown = SDL_TRUE; + biHeight = -biHeight; +@@ -163,6 +168,14 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops ExpandBMP = biBitCount; biBitCount = 8; break; @@ -26,7 +41,7 @@ From upstreah hg 12646:4646533663ae default: ExpandBMP = 0; break; -@@ -233,6 +241,10 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops +@@ -233,6 +246,10 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops if ( palette ) { if ( biClrUsed == 0 ) { biClrUsed = 1 << biBitCount; @@ -37,7 +52,7 @@ From upstreah hg 12646:4646533663ae } if ( biSize == 12 ) { for ( i = 0; i < (int)biClrUsed; ++i ) { -@@ -296,6 +308,12 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops +@@ -296,6 +313,12 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops } *(bits+i) = (pixel>>shift); pixel <<= ExpandBMP; @@ -50,7 +65,7 @@ From upstreah hg 12646:4646533663ae } } break; -@@ -306,6 +324,16 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops +@@ -306,6 +329,16 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops was_error = SDL_TRUE; goto done; } --_----------=_1589561682120390--