Debian Patches

Status for libsdl1.2/1.2.15+dfsg2-6

Patch Description Author Forwarded Bugs Origin Last update
replace-relicenced-SDL_qsort.patch no
x11_keytounicode.diff Export X11_KeyToUnicode() to legacy applications, but warn about such usage to stderr Introduced in 1.2.11-3 (Sun, 13 Aug 2006 19:03:51 +0200).
.
Upstream accepted it:
Sam Lantinga 2012-01-22 10:48:43 PST
.
At this point it's fine to leave it as an exported function, but not in the
headers.
http://hg.libsdl.org/SDL/rev/900a0fae90ca
Sam Hocevar <sam+deb@zoy.org> yes debian 2012-01-22
dont_propagate_lpthread.diff Do not propagate -lpthread to sdl-config --libs Introduced in 1.2.11-1 (Thu, 20 Jul 2006 14:17:18 +0200).
.
Upstream will not apply it at the moment:
Sam Lantinga 2012-01-22 10:54:21 PST
.
At some point it was required that multi-threaded programs using pthreads on
Linux link directly to the pthread library. I don't remember all the details,
but it had something to do with initializing C runtime variables correctly.
.
I'm sure it's not an issue anymore, but I'd rather not apply this patch in 1.2.
I'll go ahead and make this change in 1.3 though.
Sam Hocevar <sam+deb@zoy.org> yes debian 2012-01-22
fix_build_joystick_freebsd.diff FreeBSD compile fix. src/joystick/bsd/SDL_sysjoystick.c makes the invalid assumption that
__FreeBSD_kernel__ implies presence of "ucr_data" struct member. This
breaks recent versions of FreeBSD 10-CURRENT, FreeBSD 9-STABLE and
Debian GNU/kFreeBSD "wheezy/sid".
Robert Millan <rmh@debian.org> no upstream, http://hg.libsdl.org/SDL/rev/62ff1c0a103f
fix_window_resizing.diff Revert change that breaks window corner resizing http://bugzilla.libsdl.org/show_bug.cgi?id=1430 Andrew Caudwell <acaudwell@gmail.com> yes debian 2012-04-10
fix_joystick_misc_axes.diff Left/Right Joystick Axis doesn't work with some controllers Introduced in 1.2.15-3 (June 2012)
.
Reviewed in 2013-10-19 for SDL2 and SDL1.2 and submitted new upstream bug
report for re-evaluation, the previous one (suggested by the bug submitted) was
probably not related.
Sam Hocevar <sam@hocevar.net> yes debian 2013-10-19
sdl-check-for-SDL_VIDEO_X11_BACKINGSTORE.patch Do not harness backing store by default xorg-server 1.15 enables backing store if composite extension is enabled
(default settings). Harnessing backing store through compositor leads to
tearing effect.
This patch reverts default harnessing backing store to conditional use if
SDL_VIDEO_X11_BACKINGSTORE environment variable exists.
yes debian upstream https://bugs.launchpad.net/ubuntu/+source/libsdl1.2/+bug/1280665/comments/1
avoid_maybe_non-DFSG_file.patch Avoid maybe non-DFSG file Avoid use of source file with vague licensing terms regarding
modification
no debian https://git.parabola.nu/abslibre.git/log/libre/sdl/libre.patch 2017-07-17
SDL-1.2.15-vec_perm-ppc64le.patch no
CVE-2019-7572_CVE-2019-7574.patch CVE-2019-7572, CVE-2019-7574 CVE-2019-7572: a buffer over-read in IMA_ADPCM_nibble in audio/SDL_wave.c.
CVE-2019-7574: a heap-based buffer over-read in IMA_ADPCM_decode in audio/SDL_wave.c.
no
CVE-2019-7573.patch CVE-2019-7573 a heap-based buffer over-read in InitMS_ADPCM in audio/SDL_wave.c (inside the
wNumCoef loop).
no
CVE-2019-7575_7577.patch CVE-2019-7575, CVE-2019-7577 CVE-2019-7575
a heap-based buffer overflow in MS_ADPCM_decode in audio/SDL_wave.c.
CVE-2019-7577
a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c.
no
CVE-2019-7578.patch CVE-2019-7578
If IMA ADPCM format chunk was too short, InitIMA_ADPCM() parsing it
could read past the end of chunk data. This patch fixes it.
no
CVE-2019-7635_636_638.patch CVE-2019-7635_CVE-2019-7636, CVE-2019-7638 CVE-2019-7635
a heap-based buffer over-read in Blit1to4 in video/SDL_blit_1.c
CVE-2019-7636
a heap-based buffer over-read in SDL_GetRGB in video/SDL_pixels.c
CVE-2019-7638
buffer overwrite when the SDL_LoadBMP_RW()
loads colors from a file.
no
CVE-2019-7637.patch [PATCH] CVE-2019-7637: Fix in integer overflow in SDL_CalculatePitch
If a too large width is passed to SDL_SetVideoMode() the width travels
to SDL_CalculatePitch() where the width (e.g. 65535) is multiplied by
BytesPerPixel (e.g. 4) and the result is stored into Uint16 pitch
variable. During this arithmetics an integer overflow can happen (e.g.
the value is clamped as 65532). As a result SDL_Surface with a pitch
smaller than width * BytesPerPixel is created, too small pixel buffer
is allocated and when the SDL_Surface is processed in SDL_FillRect()
a buffer overflow occurs.

This can be reproduced with "./graywin -width 21312312313123213213213"
command.

This patch fixes is by using a very careful arithmetics in
SDL_CalculatePitch(). If an overflow is detected, an error is reported
back as a special 0 value. We assume that 0-width surfaces do not
occur in the wild. Since SDL_CalculatePitch() is a private function,
we can change the semantics.

CVE-2019-7637
https://bugzilla.libsdl.org/show_bug.cgi?id=4497
=?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com> no 2019-02-18
CVE-2019-7637-2.patch # HG changeset patch
# User Ozkan Sezer <sezeroz@gmail.com>
# Date 1564695305 -10800
# Node ID 32075e9e2135b4a244d13c8be9bb5e5c2ae554ec
# Parent 37d0eba8fa178404c8128850c26a06d47a2b75de
fix copy+paste mistakes in commit 9b0e5c555c0f (CVE-2019-7637 fix):

http://hg.libsdl.org/SDL/rev/9b0e5c555c0f made copy+paste mistakes which
resulted in windows versions failing to set video mode.

diff -r 37d0eba8fa17 -r 32075e9e2135 src/video/gapi/SDL_gapivideo.c
no
CVE-2019-7577-1_2.patch CVE-2019-7577 a buffer over-read in SDL_LoadWAV_RW in audio/SDL_wave.c. no
CVE-2019-13616.patch # HG changeset patch
# User Ozkan Sezer <sezeroz@gmail.com>
# Date 1564511424 -10800
# Node ID ad1bbfbca760cbf5bf8131580b24637e5e7d9411
# Parent 87d60cae0273307b2721685daf3265de5dfda634
Fixed bug 4538 - validate image size when loading BMP files

diff -r 87d60cae0273 -r ad1bbfbca760 src/video/SDL_bmp.c
no
properly_handle_focus_events.patch SDL_x11events.c: properly handle input focus events The Xorg xserver changed to send focus events on grab changes in [1]. This
patch backports upstream changes [2] and [3] from libsdl2 to libsdl1.2 to
properly handle (ignore) those events. Without this patch the focus events
will interfere with keyboard handling and cause e.g. sudden stop in games
while the forward key is still being pressed.
.
 [1] https://cgit.freedesktop.org/xorg/xserver/commit/?id=c67f2eac56518163981af59f5accb7c79bc00f6a
[2] https://hg.libsdl.org/SDL/rev/a1c4c17410e8
[3] https://hg.libsdl.org/SDL/rev/764129077d18
Maximilian Engelhardt <maxi@daemonizer.de> yes debian upstream

All known versions for source package 'libsdl1.2'

Links