SDL/src/audio
Sam Lantinga fb835f9e3b Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor
manuel.montezelo

Original bug report (note that it was against 2.0.0, it might have been fixed in between):  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733015

--------------------------------------------------------
Package: libsdl2-2.0-0
Version: 2.0.0+dfsg1-3
Severity: normal
Tags: patch

I have occasional crashes here caused by the X11 backend of SDL2. It seems to
be caused by the X11_Pending function trying to add a high number (> 1024)
file descriptor to a fd_set before doing a select on it to avoid busy waiting
on X11 events. This causes a buffer overflow because the file descriptor is
larger (or equal) than the limit FD_SETSIZE.

Attached is a possible workaround patch.

Please also keep in mind that fd_set are also used in following files which
may have similar problems.

src/audio/bsd/SDL_bsdaudio.c
src/audio/paudio/SDL_paudio.c
src/audio/qsa/SDL_qsa_audio.c
src/audio/sun/SDL_sunaudio.c
src/joystick/linux/SDL_sysjoystick.c


--------------------------------------------------------

On Tuesday 24 December 2013 00:43:13 Sven Eckelmann wrote:
> I have occasional crashes here caused by the X11 backend of SDL2. It seems
> to be caused by the X11_Pending function trying to add a high number (>
> 1024) file descriptor to a fd_set before doing a select on it to avoid busy
> waiting on X11 events. This causes a buffer overflow because the file
> descriptor is larger (or equal) than the limit FD_SETSIZE.


I personally experienced this problem while hacking on the python bindings
package for SDL2 [1] (while doing make runtest). But it easier to reproduce in
a smaller, synthetic testcase.
2017-08-14 20:22:19 -07:00
..
alsa Removed unused errno includes. 2017-05-27 23:30:07 +02:00
android Updated copyright for 2017 2017-01-01 18:33:28 -08:00
arts Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor 2017-08-14 20:22:19 -07:00
coreaudio coreaudio: we don't need to track number of allocated audio buffers anymore. 2017-05-24 13:28:13 -04:00
directsound Replaced a few single-line "//" comments. 2017-01-07 17:09:14 -05:00
disk diskaudio: Use SDL_Log, not fprintf. 2017-01-05 19:30:45 -05:00
dsp Updated copyright for 2017 2017-01-01 18:33:28 -08:00
dummy Updated copyright for 2017 2017-01-01 18:33:28 -08:00
emscripten emscripten: Fixed compiling on C89 compilers. 2017-05-26 22:45:40 +02:00
esd Updated copyright for 2017 2017-01-01 18:33:28 -08:00
fusionsound Updated copyright for 2017 2017-01-01 18:33:28 -08:00
haiku Corrected names of header file guards. 2017-06-03 23:00:15 +02:00
jack jack: removed accidental copy/paste. 2017-06-09 17:37:43 -04:00
nacl nacl: Fixed crash if allocating memory for audio device failed. 2017-05-28 21:50:47 +02:00
nas Removed newlines from error messages. 2017-03-26 21:00:19 +02:00
netbsd Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor 2017-08-14 20:22:19 -07:00
paudio Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor 2017-08-14 20:22:19 -07:00
psp psp: Force audio channels to stereo if > 2 channels requested (thanks, Solra!). 2017-08-04 16:18:34 -04:00
pulseaudio Removed unused errno includes. 2017-05-27 23:30:07 +02:00
qsa Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor 2017-08-14 20:22:19 -07:00
sndio sndio: Fix for some platforms (Linux, for example) that don't define INFTIM. 2017-08-07 00:25:18 -04:00
sun Fixed bug 2330 - Debian bug report: SDL2 X11 driver buffer overflow with large X11 file descriptor 2017-08-14 20:22:19 -07:00
wasapi Fixed crash if the WASAPI audio device couldn't be recovered 2017-07-27 22:55:18 -07:00
winmm Fixed mingw64 32-bit build, which does have the correct structure definitions 2017-01-19 20:19:37 -08:00
xaudio2 Log the error returned by XAudio2Create() 2017-02-09 06:01:14 -08:00
SDL_audio_c.h audio: Offer a hint for libsamplerate quality/speed tradeoff. 2017-01-24 15:52:22 -05:00
SDL_audio.c Fixed bug 3702 - Clear error messages of SDL_LoadObject for optional libraries 2017-08-11 10:21:19 -07:00
SDL_audiocvt.c audio: trying to pacify static analysis. 2017-07-05 12:04:37 -04:00
SDL_audiodev_c.h Updated copyright for 2017 2017-01-01 18:33:28 -08:00
SDL_audiodev.c audio: rename bsd target to netbsd. 2017-05-24 19:56:59 -04:00
SDL_audiotypecvt.c audio: Fixed copy/paste bug in float32->sint16/SSE2 scalar leftover code. 2017-01-23 12:14:28 -05:00
SDL_mixer.c Updated copyright for 2017 2017-01-01 18:33:28 -08:00
SDL_sysaudio.h qnx: Removed unused bootstrap declaration. 2017-07-02 22:46:00 +02:00
SDL_wave.c audio: Added basic WAVE_FORMAT_EXTENSIBLE support to .wav loader. 2017-02-17 02:25:37 -05:00
SDL_wave.h audio: Added basic WAVE_FORMAT_EXTENSIBLE support to .wav loader. 2017-02-17 02:25:37 -05:00