[ Reason ]
Backport two out-of-bounds reads, one of which has a CVE ID, presumably
because it could be an exploitable vulnerability for games that are
willing to load untrusted graphics data.
The security team marked the CVE as unimportant and didn't open a bug,
so presumably they don't intend to do a DSA.
[ Impact ]
If not approved, SDL games that load untrusted graphics could maybe be
crashed or otherwise interfered with by an attacker.
[ Tests ]
No specific test coverage. From the upstream bug reports, it seems that
these issues are usually only noticeable in practice if SDL is rebuilt
with AddressSanitizer.
The proposed version seems to work OK in brief testing with a few games
(0ad, openarena, warzone2100).
[ Risks ]
Low risk: the patches are trivial and have been in testing since January
without apparent regressions.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
d/p/Fixed-potential-buffer-overflow-in-YUV-conversion.patch,
src/video/yuv2rgb/yuv_rgb.c: ensure that the index in a 512-element
lookup table is clamped to the range 0 to 511 inclusive, even if the input
data is malformed.
d/p/Always-create-a-full-256-entry-map-in-case-color-values-a.patch,
src/video/SDL_pixels.c: always allocate palettes for palette-based formats
with 256 entries and zero out the ones that are not used, so that
out-of-range pixel values resolve to transparent black
(red = green = blue = alpha = 0) instead of causing an out-of-bounds read.