CVS commit: pkgsrc/devel/SDL

["Nia Alarie" <nia%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   nia
Date:           Thu Feb 27 10:58:28 UTC 2025

Modified Files:
        pkgsrc/devel/SDL: Makefile distinfo
Added Files:
        pkgsrc/devel/SDL/patches: patch-src_video_x11_SDL__x11yuv.c

Log Message:
SDL: Apply patch for CVE-2022-34568.


To generate a diff of this commit:
cvs rdiff -u -r1.155 -r1.156 pkgsrc/devel/SDL/Makefile
cvs rdiff -u -r1.87 -r1.88 pkgsrc/devel/SDL/distinfo
cvs rdiff -u -r0 -r1.1 \
    pkgsrc/devel/SDL/patches/patch-src_video_x11_SDL__x11yuv.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/SDL/Makefile
diff -u pkgsrc/devel/SDL/Makefile:1.155 pkgsrc/devel/SDL/Makefile:1.156
--- pkgsrc/devel/SDL/Makefile:1.155     Wed Feb 12 06:44:34 2025
+++ pkgsrc/devel/SDL/Makefile   Thu Feb 27 10:58:28 2025
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.155 2025/02/12 06:44:34 ryoon Exp $
+# $NetBSD: Makefile,v 1.156 2025/02/27 10:58:28 nia Exp $
 
 DISTNAME=      SDL-1.2.15
-PKGREVISION=   45
+PKGREVISION=   46
 CATEGORIES=    devel games
 MASTER_SITES=  http://www.libsdl.org/release/
 

Index: pkgsrc/devel/SDL/distinfo
diff -u pkgsrc/devel/SDL/distinfo:1.87 pkgsrc/devel/SDL/distinfo:1.88
--- pkgsrc/devel/SDL/distinfo:1.87      Wed Jan 17 06:02:52 2024
+++ pkgsrc/devel/SDL/distinfo   Thu Feb 27 10:58:28 2025
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.87 2024/01/17 06:02:52 nat Exp $
+$NetBSD: distinfo,v 1.88 2025/02/27 10:58:28 nia Exp $
 
 BLAKE2s (SDL-1.2.15.tar.gz) = 4c189e4973635d37bbc9a4d87512bbbeb950d49c4862bc59f1bf2c37b9c54cc7
 SHA512 (SDL-1.2.15.tar.gz) = ac392d916e6953b0925a7cbb0f232affea33339ef69b47a0a7898492afb9784b93138986df53d6da6d3e2ad79af1e9482df565ecca30f89428be0ae6851b1adc
@@ -18,4 +18,5 @@ SHA1 (patch-src_video_wscons_SDL__wscons
 SHA1 (patch-src_video_wscons_SDL__wsconsevents__c.h) = 97206e2aca0b620005217d9d07ad1177516cac92
 SHA1 (patch-src_video_wscons_SDL__wsconsvideo.c) = 741ac9570c4e6e554a191660011b7e3bbe30ce7c
 SHA1 (patch-src_video_wscons_SDL__wsconsvideo.h) = efc75da910cfe370b7361a0b9d2b90837c6b9aa9
+SHA1 (patch-src_video_x11_SDL__x11yuv.c) = 195cc9bd2288fdae267f8545f099359790b14c12
 SHA1 (patch-src_video_x11_SDL_x11video.c) = 249d2bcc6194be739e46a7ea2288da61d0c941e4

Added files:

Index: pkgsrc/devel/SDL/patches/patch-src_video_x11_SDL__x11yuv.c
diff -u /dev/null pkgsrc/devel/SDL/patches/patch-src_video_x11_SDL__x11yuv.c:1.1
--- /dev/null   Thu Feb 27 10:58:28 2025
+++ pkgsrc/devel/SDL/patches/patch-src_video_x11_SDL__x11yuv.c  Thu Feb 27 10:58:28 2025
@@ -0,0 +1,22 @@
+$NetBSD: patch-src_video_x11_SDL__x11yuv.c,v 1.1 2025/02/27 10:58:28 nia Exp $
+
+[PATCH] SDL_x11yuv.c: fix possible use-after-free
+
+Fixes: https://github.com/libsdl-org/SDL-1.2/issues/863
+
+https://github.com/libsdl-org/SDL-1.2/commit/d7e00208738a0bc6af302723fe64908ac35b777b.patch
+
+CVE-2022-34568
+
+--- src/video/x11/SDL_x11yuv.c.orig    2012-01-19 06:30:06.000000000 +0000
++++ src/video/x11/SDL_x11yuv.c
+@@ -374,8 +374,8 @@ SDL_Overlay *X11_CreateYUVOverlay(_THIS,
+ #ifdef PITCH_WORKAROUND
+               if ( hwdata->image != NULL && hwdata->image->pitches[0] != (width*bpp) ) {
+                       /* Ajust overlay width according to pitch */ 
+-                      XFree(hwdata->image);
+                       width = hwdata->image->pitches[0] / bpp;
++                      XFree(hwdata->image);
+                       hwdata->image = SDL_NAME(XvCreateImage)(GFX_Display, xv_port, format,
+                                                               0, width, height);
+               }