alibaba / alibaba/AliOS-Things

[Bug Report]: Patch for CVE-2019-14906 in reused component SDL2

Open
#2,019 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
C
Stars
4.6k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

### Contact Details

weitingcai2020@gmail.com

### What happened?

我通过使用V1SCAN(一个扫描存在于复用代码中1-Day漏洞的工具),发现您的项目中components/SDL2/src/image/IMG_bmp.c文件中的SDL_LoadBMP_RW函数可能存在CWE-125 Out-of-bounds Read漏洞,相关触发逻辑类似https://github.com/advisories/GHSA-2w82-mm6w-3vc9, 具体参考链接如下:

CVE-2019-14906:
NVD说明链接:
https://nvd.nist.gov/vuln/detail/CVE-2019-14906

修复方法:
在components/SDL2/src/image/SDL_bmp.c文件中的SDL_LoadBMP_RW函数中,第373行后, 374行 case 2: 上方 插入如下代码(插入后该代码段为374行):
`case 0:`

考虑到其可能存在的潜在风险,我愿意配合您以负责任的方式及时核实、解决和报告发现的漏洞。 如果您需要任何进一步的信息或帮助,请随时与我联系。如果需要,我也可以提交PR帮助您修复。 谢谢您,期待尽快收到您的回复!

### Version

master (Default)

### What soultions are you seeing the problem on?

_No response_

### Relevant log output

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by comparing components/SDL2/src/image/IMG_bmp.c with the referenced components/SDL2/src/image/SDL_bmp.c and inspect SDL_LoadBMP_RW around the stated line and case labels. Check the CVE-2019-14906 behavior and verify that the resulting code no longer permits the reported out-of-bounds read.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
embedded-iot, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.