Vulnerability: SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.
Vulnerability ID: CVE-2022-27470
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/libsdl-org/SDL_ttf
Published: 2022-05-04
File: SDL_ttf.c
Commit message: More integer overflow (see bug #187)
Make sure that 'width + alignment' doesn't overflow, otherwise
it could create a SDL_Surface of 'width' but with wrong 'pitch'
Commit author: Sylvain

Vulnerable version (before fix):
 static SDL_Surface* Create_Surface_Solid(int width, int height, SDL_Color fg, Ui      */     void *pixels, *ptr;     /* Worse case at the end of line pulling 'alignment' extra blank pixels */     Sint64 pitch = width + alignment;     pitch += alignment;     pitch &= ~alignment;     size = height * pitch + sizeof (void *) + alignment; static SDL_Surface* Create_Surface_Shaded(int width, int height, SDL_Color fg, S      */     void *pixels, *ptr;     /* Worse case at the end of line pulling 'alignment' extra blank pixels */     Sint64 pitch = width + alignment;     pitch += alignment;     pitch &= ~alignment;     size = height * pitch + sizeof (void *) + alignment; static SDL_Surface *Create_Surface_Blended(int width, int height, SDL_Color fg,         Sint64 size;         void *pixels, *ptr;         /* Worse case at the end of line pulling 'alignment' extra blank pixels */         Sint64 pitch = (width + alignment) * 4;         pitch += alignment;         pitch &= ~alignment;         size = height * pitch + sizeof (void *) + alignment;

Fixed version (after fix):
 static SDL_Surface* Create_Surface_Solid(int width, int height, SDL_Color fg, Ui      */     void *pixels, *ptr;     /* Worse case at the end of line pulling 'alignment' extra blank pixels */     Sint64 pitch = (Sint64)width + (Sint64)alignment;     pitch += alignment;     pitch &= ~alignment;     size = height * pitch + sizeof (void *) + alignment; static SDL_Surface* Create_Surface_Shaded(int width, int height, SDL_Color fg, S      */     void *pixels, *ptr;     /* Worse case at the end of line pulling 'alignment' extra blank pixels */     Sint64 pitch = (Sint64)width + (Sint64)alignment;     pitch += alignment;     pitch &= ~alignment;     size = height * pitch + sizeof (void *) + alignment; static SDL_Surface *Create_Surface_Blended(int width, int height, SDL_Color fg,         Sint64 size;         void *pixels, *ptr;         /* Worse case at the end of line pulling 'alignment' extra blank pixels */         Sint64 pitch = ((Sint64)width + (Sint64)alignment) * 4;         pitch += alignment;         pitch &= ~alignment;         size = height * pitch + sizeof (void *) + alignment;

Patch:
patch: @@ -1257,7 +1257,7 @@ static SDL_Surface* Create_Surface_Solid(int width, int height, SDL_Color fg, Ui
      */
     void *pixels, *ptr;
     /* Worse case at the end of line pulling 'alignment' extra blank pixels */
-    Sint64 pitch = width + alignment;
+    Sint64 pitch = (Sint64)width + (Sint64)alignment;
     pitch += alignment;
     pitch &= ~alignment;
     size = height * pitch + sizeof (void *) + alignment;
@@ -1321,7 +1321,7 @@ static SDL_Surface* Create_Surface_Shaded(int width, int height, SDL_Color fg, S
      */
     void *pixels, *ptr;
     /* Worse case at the end of line pulling 'alignment' extra blank pixels */
-    Sint64 pitch = width + alignment;
+    Sint64 pitch = (Sint64)width + (Sint64)alignment;
     pitch += alignment;
     pitch &= ~alignment;
     size = height * pitch + sizeof (void *) + alignment;
@@ -1418,7 +1418,7 @@ static SDL_Surface *Create_Surface_Blended(int width, int height, SDL_Color fg,
         Sint64 size;
         void *pixels, *ptr;
         /* Worse case at the end of line pulling 'alignment' extra blank pixels */
-        Sint64 pitch = (width + alignment) * 4;
+        Sint64 pitch = ((Sint64)width + (Sint64)alignment) * 4;
         pitch += alignment;
         pitch &= ~alignment;
         size = height * pitch + sizeof (void *) + alignment;
path: SDL_ttf.c