Package init

2019-11-19 11:57:04 +08:00 · 2019-11-19 11:57:04 +08:00 · b8f4de38dc
commit b8f4de38dc
19 changed files with 987 additions and 0 deletions
--- a/CVE-2019-7573_CVE-2019-7576.patch
+++ b/CVE-2019-7573_CVE-2019-7576.patch
@ -0,0 +1,56 @@
 --- a/src/audio/SDL_wave.c	2012-01-19 14:30:06.000000000 +0800
 +++ b/src/audio/SDL_wave.c	2019-04-22 12:07:56.181000000 +0800
@@ -44,12 +44,13 @@ static struct MS_ADPCM_decoder {
 	struct MS_ADPCM_decodestate state[2];
 } MS_ADPCM_state;
 -static int InitMS_ADPCM(WaveFMT *format)
 +static int InitMS_ADPCM(WaveFMT *format, int length)
 {
 -	Uint8 *rogue_feel;
 +	Uint8 *rogue_feel, *rogue_feel_end;
 	int i;
 	/* Set the rogue pointer to the MS_ADPCM specific data */
 +	if (length < sizeof(*format)) goto too_short;
 	MS_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding);
 	MS_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels);
 	MS_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency);
@@ -58,9 +59,11 @@ static int InitMS_ADPCM(WaveFMT *format)
 	MS_ADPCM_state.wavefmt.bitspersample =
 					 SDL_SwapLE16(format->bitspersample);
 	rogue_feel = (Uint8 *)format+sizeof(*format);
 +	rogue_feel_end = (Uint8 *)format + length;
 	if ( sizeof(*format) == 16 ) {
 		rogue_feel += sizeof(Uint16);
 	}
 +	if (rogue_feel + 4 > rogue_feel_end) goto too_short;
 	MS_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]);
 	rogue_feel += sizeof(Uint16);
 	MS_ADPCM_state.wNumCoef = ((rogue_feel[1]<<8)|rogue_feel[0]);
@@ -70,12 +73,16 @@ static int InitMS_ADPCM(WaveFMT *format)
 		return(-1);
 	}
 	for ( i=0; i<MS_ADPCM_state.wNumCoef; ++i ) {
 +		if (rogue_feel + 4 > rogue_feel_end) goto too_short;
 		MS_ADPCM_state.aCoeff[i][0] = ((rogue_feel[1]<<8)|rogue_feel[0]);
 		rogue_feel += sizeof(Uint16);
 		MS_ADPCM_state.aCoeff[i][1] = ((rogue_feel[1]<<8)|rogue_feel[0]);
 		rogue_feel += sizeof(Uint16);
 	}
 	return(0);
 +too_short:
 +	SDL_SetError("Unexpected length of a chunk with a MS ADPCM format");
 +	return(-1);
 }
 static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state,
@@ -461,7 +468,7 @@ SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
 			break;
 		case MS_ADPCM_CODE:
 			/* Try to understand this */
 -			if ( InitMS_ADPCM(format) < 0 ) {
 +			if ( InitMS_ADPCM(format, lenread) < 0 ) {
 				was_error = 1;
 				goto done;
 			}
--- a/CVE-2019-7577.patch
+++ b/CVE-2019-7577.patch
@ -0,0 +1,70 @@
 --- a/src/audio/SDL_wave.c	2012-01-19 14:30:06.000000000 +0800
 +++ b/src/audio/SDL_wave.c	2019-04-22 15:40:50.023000000 +0800
@@ -115,7 +115,7 @@ static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state,
 static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 {
 	struct MS_ADPCM_decodestate *state[2];
 -	Uint8 *freeable, *encoded, *decoded;
 +	Uint8 *freeable, *encoded, *encoded_end, *decoded;
 	Sint32 encoded_len, samplesleft;
 	Sint8 nybble, stereo;
 	Sint16 *coeff[2];
@@ -124,6 +124,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	/* Allocate the proper sized output buffer */
 	encoded_len = *audio_len;
 	encoded = *audio_buf;
 +	encoded_end = encoded + encoded_len;
 	freeable = *audio_buf;
 	*audio_len = (encoded_len/MS_ADPCM_state.wavefmt.blockalign) * 
 				MS_ADPCM_state.wSamplesPerBlock*
@@ -141,6 +142,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	state[1] = &MS_ADPCM_state.state[stereo];
 	while ( encoded_len >= MS_ADPCM_state.wavefmt.blockalign ) {
 		/* Grab the initial information for this block */
 +		if (encoded + 7 + (stereo ? 7 : 0) > encoded_end) goto too_short;
 		state[0]->hPredictor = *encoded++;
 		if ( stereo ) {
 			state[1]->hPredictor = *encoded++;
@@ -188,6 +190,8 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 		samplesleft = (MS_ADPCM_state.wSamplesPerBlock-2)*
 					MS_ADPCM_state.wavefmt.channels;
 		while ( samplesleft > 0 ) {
 +			if (encoded + 1 > encoded_end) goto too_short;
 +
 			nybble = (*encoded)>>4;
 			new_sample = MS_ADPCM_nibble(state[0],nybble,coeff[0]);
 			decoded[0] = new_sample&0xFF;
@@ -209,6 +213,10 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	}
 	SDL_free(freeable);
 	return(0);
 +too_short:
 +	SDL_SetError("Too short chunk for a MS ADPCM decoder");
 +	SDL_free(freeable);
 +	return(-1);
 }
 struct IMA_ADPCM_decodestate {
 --- a/src/audio/SDL_wave.c	2019-04-22 04:32:30.989000000 -0400
 +++ b/src/audio/SDL_wave.c	2019-04-22 05:26:47.003000000 -0400
@@ -154,6 +154,9 @@ static int MS_ADPCM_decode(Uint8 **audio
 		if ( stereo ) {
 			state[1]->hPredictor = *encoded++;
 		}
 +		if (state[0]->hPredictor >= 7 || state[1]->hPredictor >= 7) {
 +			goto invalid_predictor;
 +		}
 		state[0]->iDelta = ((encoded[1]<<8)|encoded[0]);
 		encoded += sizeof(Sint16);
 		if ( stereo ) {
@@ -224,6 +227,10 @@ too_short:
 	SDL_SetError("Too short chunk for a MS ADPCM decoder");
 	SDL_free(freeable);
 	return(-1);
 +invalid_predictor:
 +	SDL_SetError("Invalid predictor value for a MS ADPCM decoder");
 +	SDL_free(freeable);
 +	return(-1);
 }
 struct IMA_ADPCM_decodestate {
--- a/CVE-2019-7578.patch
+++ b/CVE-2019-7578.patch
@ -0,0 +1,43 @@
 --- a/src/audio/SDL_wave.c	2019-04-22 05:35:16.821000000 -0400
 +++ b/src/audio/SDL_wave.c	2019-04-22 05:42:21.381000000 -0400
@@ -232,11 +232,12 @@ static struct IMA_ADPCM_decoder {
 	struct IMA_ADPCM_decodestate state[2];
 } IMA_ADPCM_state;
 -static int InitIMA_ADPCM(WaveFMT *format)
 +static int InitIMA_ADPCM(WaveFMT *format, int length)
 {
 -	Uint8 *rogue_feel;
 +	Uint8 *rogue_feel, *rogue_feel_end;
 	/* Set the rogue pointer to the IMA_ADPCM specific data */
 +	if (length < sizeof(*format)) goto too_short;
 	IMA_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding);
 	IMA_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels);
 	IMA_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency);
@@ -245,11 +246,16 @@ static int InitIMA_ADPCM(WaveFMT *format
 	IMA_ADPCM_state.wavefmt.bitspersample =
 					 SDL_SwapLE16(format->bitspersample);
 	rogue_feel = (Uint8 *)format+sizeof(*format);
 +	rogue_feel_end = (Uint8 *)format + length;
 	if ( sizeof(*format) == 16 ) {
 		rogue_feel += sizeof(Uint16);
 	}
 +	if (rogue_feel + 2 > rogue_feel_end) goto too_short;
 	IMA_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]);
 	return(0);
 +too_short:
 +	SDL_SetError("Unexpected length of a chunk with an IMA ADPCM format");
 +	return(-1);
 }
 static Sint32 IMA_ADPCM_nibble(struct IMA_ADPCM_decodestate *state,Uint8 nybble)
@@ -479,7 +485,7 @@ SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWop
 			break;
 		case IMA_ADPCM_CODE:
 			/* Try to understand this */
 -			if ( InitIMA_ADPCM(format) < 0 ) {
 +			if ( InitIMA_ADPCM(format, lenread) < 0 ) {
 				was_error = 1;
 				goto done;
 			}
--- a/CVE-2019-7635_1.patch
+++ b/CVE-2019-7635_1.patch
@ -0,0 +1,32 @@
 --- a/src/video/SDL_bmp.c	2012-01-19 14:30:06.000000000 +0800
 +++ b/src/video/SDL_bmp.c	2019-04-22 11:29:33.990000000 +0800
@@ -296,6 +296,12 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops
 				}
 				*(bits+i) = (pixel>>shift);
 				pixel <<= ExpandBMP;
 +				if ( bits[i] >= biClrUsed ) {
 +					SDL_SetError(
 +						"A BMP image contains a pixel with a color out of the palette");
 +					was_error = SDL_TRUE;
 +					goto done;
 +				}
 			} }
 			break;
@@ -306,6 +312,16 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops
 				was_error = SDL_TRUE;
 				goto done;
 			}
 +			if ( 8 == biBitCount && palette && biClrUsed < (1 << biBitCount ) ) {
 +				for ( i=0; i<surface->w; ++i ) {
 +					if ( bits[i] >= biClrUsed ) {
 +						SDL_SetError(
 +							"A BMP image contains a pixel with a color out of the palette");
 +						was_error = SDL_TRUE;
 +						goto done;
 +					}
 +				}
 +			}
 #if SDL_BYTEORDER == SDL_BIG_ENDIAN
 			/* Byte-swap the pixels if needed. Note that the 24bpp
 			   case has already been taken care of above. */
--- a/CVE-2019-7635_2.patch
+++ b/CVE-2019-7635_2.patch
@ -0,0 +1,17 @@
 --- a/src/video/SDL_bmp.c	2012-01-19 14:30:06.000000000 +0800
 +++ b/src/video/SDL_bmp.c	2019-04-22 11:34:08.793000000 +0800
@@ -163,6 +163,14 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops
 			ExpandBMP = biBitCount;
 			biBitCount = 8;
 			break;
 +		case 2:
 +		case 3:
 +		case 5:
 +		case 6:
 +		case 7:
 +			SDL_SetError("%d-bpp BMP images are not supported", biBitCount);
 +			was_error = SDL_TRUE;
 +			goto done;
 		default:
 			ExpandBMP = 0;
 			break;
--- a/CVE-2019-7636.patch
+++ b/CVE-2019-7636.patch
@ -0,0 +1,13 @@
 --- a/src/video/SDL_bmp.c	Sun Jan 13 15:27:50 2019 +0100
 +++ b/src/video/SDL_bmp.c	Mon Feb 18 07:48:23 2019 -0800
@@ -233,6 +233,10 @@
 	if ( palette ) {
 		if ( biClrUsed == 0 ) {
 			biClrUsed = 1 << biBitCount;
 +		} else if ( biClrUsed > (1 << biBitCount) ) {
 +			SDL_SetError("BMP file has an invalid number of colors");
 +			was_error = SDL_TRUE;
 +			goto done;
 		}
 		if ( biSize == 12 ) {
 			for ( i = 0; i < (int)biClrUsed; ++i ) {
--- a/CVE-2019-7637.patch
+++ b/CVE-2019-7637.patch
@ -0,0 +1,149 @@
 --- a/src/video/SDL_pixels.c	Sat Mar 16 18:35:33 2019 -0700
 +++ b/src/video/SDL_pixels.c	Sat Mar 16 19:16:24 2019 -0700
@@ -286,26 +286,53 @@
 	}
 }
 /* 
 - * Calculate the pad-aligned scanline width of a surface
 + * Calculate the pad-aligned scanline width of a surface. Return 0 in case of
 + * an error.
  */
 Uint16 SDL_CalculatePitch(SDL_Surface *surface)
 {
 -	Uint16 pitch;
 +	unsigned int pitch = 0;
 	/* Surface should be 4-byte aligned for speed */
 -	pitch = surface->w*surface->format->BytesPerPixel;
 +	/* The code tries to prevent from an Uint16 overflow. */;
 +	for (Uint8 byte = surface->format->BytesPerPixel; byte; byte--) {
 +		pitch += (unsigned int)surface->w;
 +		if (pitch < surface->w) {
 +			SDL_SetError("A scanline is too wide");
 +			return(0);
 +		}
 +	}
 	switch (surface->format->BitsPerPixel) {
 		case 1:
 -			pitch = (pitch+7)/8;
 +			if (pitch % 8) {
 +				pitch = pitch / 8 + 1;
 +			} else {
 +				pitch = pitch / 8;
 +			}
 			break;
 		case 4:
 -			pitch = (pitch+1)/2;
 +			if (pitch % 2) {
 +				pitch = pitch / 2 + 1;
 +			} else {
 +				pitch = pitch / 2;
 +			}
 			break;
 		default:
 			break;
 	}
 -	pitch = (pitch + 3) & ~3;	/* 4-byte aligning */
 -	return(pitch);
 +	/* 4-byte aligning */
 +	if (pitch & 3) {
 +		if (pitch + 3 < pitch) {
 +			SDL_SetError("A scanline is too wide");
 +			return(0);
 +		}
 +		pitch = (pitch + 3) & ~3;
 +	}
 +	if (pitch > 0xFFFF) {
 +		SDL_SetError("A scanline is too wide");
 +		return(0);
 +	}
 +	return((Uint16)pitch);
 }
 /*
  * Match an RGB value to a particular palette index
 --- a/src/video/gapi/SDL_gapivideo.c	Sat Mar 16 18:35:33 2019 -0700
 +++ b/src/video/gapi/SDL_gapivideo.c	Sat Mar 16 19:16:24 2019 -0700
@@ -733,6 +733,9 @@
 	video->w = gapi->w = width;
 	video->h = gapi->h = height;
 	video->pitch = SDL_CalculatePitch(video); 
 +	if (!current->pitch) {
 +		return(NULL);
 +	}
 	/* Small fix for WinCE/Win32 - when activating window
 	   SDL_VideoSurface is equal to zero, so activating code
 --- a/src/video/nanox/SDL_nxvideo.c	Sat Mar 16 18:35:33 2019 -0700
 +++ b/src/video/nanox/SDL_nxvideo.c	Sat Mar 16 19:16:24 2019 -0700
@@ -378,6 +378,10 @@
         current -> w = width ;
         current -> h = height ;
         current -> pitch = SDL_CalculatePitch (current) ;
 +        if (!current->pitch) {
 +            current = NULL;
 +            goto done;
 +        }
         NX_ResizeImage (this, current, flags) ;
     }
 --- a/src/video/ps2gs/SDL_gsvideo.c	Sat Mar 16 18:35:33 2019 -0700
 +++ b/src/video/ps2gs/SDL_gsvideo.c	Sat Mar 16 19:16:24 2019 -0700
@@ -479,6 +479,9 @@
 	current->w = width;
 	current->h = height;
 	current->pitch = SDL_CalculatePitch(current);
 +	if (!current->pitch) {
 +		return(NULL);
 +	}
 	/* Memory map the DMA area for block memory transfer */
 	if ( ! mapped_mem ) {
 --- a/src/video/ps3/SDL_ps3video.c	Sat Mar 16 18:35:33 2019 -0700
 +++ b/src/video/ps3/SDL_ps3video.c	Sat Mar 16 19:16:24 2019 -0700
@@ -339,6 +339,9 @@
 	current->w = width;
 	current->h = height;
 	current->pitch = SDL_CalculatePitch(current);
 +	if (!current->pitch) {
 +		return(NULL);
 +	}
 	/* Alloc aligned mem for current->pixels */
 	s_pixels = memalign(16, current->h * current->pitch);
 --- a/src/video/windib/SDL_dibvideo.c	Sat Mar 16 18:35:33 2019 -0700
 +++ b/src/video/windib/SDL_dibvideo.c	Sat Mar 16 19:16:24 2019 -0700
@@ -675,6 +675,9 @@
 	video->w = width;
 	video->h = height;
 	video->pitch = SDL_CalculatePitch(video);
 +	if (!current->pitch) {
 +		return(NULL);
 +	}
 	/* Small fix for WinCE/Win32 - when activating window
 	   SDL_VideoSurface is equal to zero, so activating code
 --- a/src/video/windx5/SDL_dx5video.c	Sat Mar 16 18:35:33 2019 -0700
 +++ b/src/video/windx5/SDL_dx5video.c	Sat Mar 16 19:16:24 2019 -0700
@@ -1127,6 +1127,9 @@
 		video->w = width;
 		video->h = height;
 		video->pitch = SDL_CalculatePitch(video);
 +		if (!current->pitch) {
 +			return(NULL);
 +		}
 #ifndef NO_CHANGEDISPLAYSETTINGS
 		/* Set fullscreen mode if appropriate.
 --- a/src/video/x11/SDL_x11video.c	Sat Mar 16 18:35:33 2019 -0700
 +++ b/src/video/x11/SDL_x11video.c	Sat Mar 16 19:16:24 2019 -0700
@@ -1225,6 +1225,10 @@
 		current->w = width;
 		current->h = height;
 		current->pitch = SDL_CalculatePitch(current);
 +		if (!current->pitch) {
 +			current = NULL;
 +			goto done;
 +		}
 		if (X11_ResizeImage(this, current, flags) < 0) {
 			current = NULL;
 			goto done;
--- a/SDL-1.2.10-GrabNotViewable.patch
+++ b/SDL-1.2.10-GrabNotViewable.patch
@ -0,0 +1,22 @@
 Makes SDL-1.2 SDL_WM_GrabInput() non-blocking in case of SDL window is not
 viewable. Patch provided by <pbonzini@redhat.com>.
 See <http://bugzilla.libsdl.org/show_bug.cgi?id=1155>.
 --- ./src/video/x11/SDL_x11wm.c	2007-12-31 04:48:13.000000000 +0000
 +++ ./src/video/x11/SDL_x11wm.c	2009-01-15 10:27:14.000000000 +0000
@@ -351,13 +351,14 @@ SDL_GrabMode X11_GrabInputNoLock(_THIS, 
 			result = XGrabPointer(SDL_Display, SDL_Window, True, 0,
 						GrabModeAsync, GrabModeAsync,
 						SDL_Window, None, CurrentTime);
 -			if ( result == GrabSuccess ) {
 +			if ( result == GrabSuccess || result == GrabNotViewable ) {
 				break;
 			}
 			SDL_Delay(100);
 		}
 		if ( result != GrabSuccess ) {
 			/* Uh, oh, what do we do here? */ ;
 +			return(SDL_GRAB_OFF);
 		}
 		/* Now grab the keyboard */
 		XGrabKeyboard(SDL_Display, WMwindow, True,
--- a/SDL-1.2.12-multilib.patch
+++ b/SDL-1.2.12-multilib.patch
@ -0,0 +1,25 @@
 diff -up SDL-1.2.12/sdl-config.in.multilib SDL-1.2.12/sdl-config.in
 --- SDL-1.2.12/sdl-config.in.multilib	2007-07-20 07:52:45.000000000 +0200
 +++ SDL-1.2.12/sdl-config.in	2007-11-06 17:07:25.000000000 +0100
@@ -3,7 +3,6 @@
 prefix=@prefix@
 exec_prefix=@exec_prefix@
 exec_prefix_set=no
 -libdir=@libdir@
 @ENABLE_STATIC_FALSE@usage="\
 @ENABLE_STATIC_FALSE@Usage: sdl-config [--prefix[=DIR]] [--exec-prefix[=DIR]] [--version] [--cflags] [--libs]"
@@ -45,11 +44,11 @@ while test $# -gt 0; do
       echo -I@includedir@/SDL @SDL_CFLAGS@
       ;;
 @ENABLE_SHARED_TRUE@    --libs)
 -@ENABLE_SHARED_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_LIBS@
 +@ENABLE_SHARED_TRUE@      echo @SDL_RLD_FLAGS@ @SDL_LIBS@
 @ENABLE_SHARED_TRUE@      ;;
 @ENABLE_STATIC_TRUE@@ENABLE_SHARED_TRUE@    --static-libs)
 @ENABLE_STATIC_TRUE@@ENABLE_SHARED_FALSE@    --libs|--static-libs)
 -@ENABLE_STATIC_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_STATIC_LIBS@
 +@ENABLE_STATIC_TRUE@      echo @SDL_RLD_FLAGS@ @SDL_STATIC_LIBS@
 @ENABLE_STATIC_TRUE@      ;;
     *)
       echo "${usage}" 1>&2
--- a/SDL-1.2.15-SDL_EnableUNICODE_drops_keyboard_events.patch
+++ b/SDL-1.2.15-SDL_EnableUNICODE_drops_keyboard_events.patch
@ -0,0 +1,73 @@
 # HG changeset patch
 # User Sam Lantinga <slouken@libsdl.org>
 # Date 1397799374 25200
 #      Thu Apr 17 22:36:14 2014 -0700
 # Branch SDL-1.2
 # Node ID 0aade9c0203f717fe4b823a176c3c040f1a709f8
 # Parent  22a7f096bb9d4d596f35a93e33608825693462b0
 Fixed bug 2325 - SDL_EnableUNICODE sometimes drops keyboard events completely
 Rafał Mużyło
 The most annoying part of this bug is that though I've found it in two separate apps, I don't have a trivial testcase for it.
 The problem seems to be a condition race, as it's triggered quite randomly (therefore it will be hard to tell whether it really gets fixed, if a probable fix is found).
 While it's specific to SDL 1.2, it seems quite similar to the problem described and fixed in http://forums.libsdl.org/viewtopic.php?p=40503.
 Now, I should start describing the problem.
 A game uses Escape to open menu (the exact key might not be important). Upon opening, it calls SDL_EnableUNICODE(1). Upon closing it calls SDL_EnableUNICODE(0).
 I have an IME running.
 Game uses SDL_PollEvent to get the events.
 If Escape is pressed repeatedly, menu is opened and closed, till it eventually freezes in open state.
 "freezes" in this context means "app itself still runs, but no keyboard events are getting delivered (though - for example - mouse events still are)". "getting delivered" should mean "SDL_PollEvent is not receiving any".
 If it matters, the last delivered keyboard event is a keypress, the release never arrives.
 It seems (no guarantees, due to random nature of the freeze) that unsetting XMODIFIERS (which - AFAIU - will disable IME as far as SDL is concerned) prevents the freeze, therefore the reference to that SDL2 thread.
 diff -r 22a7f096bb9d -r 0aade9c0203f src/video/x11/SDL_x11events.c
 --- a/src/video/x11/SDL_x11events.c	Sun Dec 01 00:00:17 2013 -0500
 +++ b/src/video/x11/SDL_x11events.c	Thu Apr 17 22:36:14 2014 -0700
@@ -395,6 +395,8 @@
 {
 	int posted;
 	XEvent xevent;
 +	int orig_event_type;
 +	KeyCode orig_keycode;
 	SDL_memset(&xevent, '\0', sizeof (XEvent));  /* valgrind fix. --ryan. */
 	XNextEvent(SDL_Display, &xevent);
@@ -410,9 +412,29 @@
 #ifdef X_HAVE_UTF8_STRING
 	/* If we are translating with IM, we need to pass all events
 	   to XFilterEvent, and discard those filtered events immediately.  */
 +	orig_event_type = xevent.type;
 +	if (orig_event_type == KeyPress || orig_event_type == KeyRelease) {
 +	     orig_keycode = xevent.xkey.keycode;
 +	} else {
 +	     orig_keycode = 0;
 +	}
 	if ( SDL_TranslateUNICODE
 	     && SDL_IM != NULL
 	     && XFilterEvent(&xevent, None) ) {
 +	        if (orig_keycode) {
 +	            SDL_keysym keysym;
 +	            static XComposeStatus state;
 +	            char keybuf[32];
 +
 +	            keysym.scancode = xevent.xkey.keycode;
 +	            keysym.sym = X11_TranslateKeycode(SDL_Display, xevent.xkey.keycode);
 +	            keysym.mod = KMOD_NONE;
 +	            keysym.unicode = 0;
 +	            if (orig_event_type == KeyPress && XLookupString(&xevent.xkey, keybuf, sizeof(keybuf), NULL, &state))
 +	                keysym.unicode = (Uint8)keybuf[0];
 +
 +	            SDL_PrivateKeyboard(orig_event_type == KeyPress ? SDL_PRESSED : SDL_RELEASED, &keysym);
 +	        }
 		return 0;
 	}
 #endif
--- a/SDL-1.2.15-add_sdl_config_man.patch
+++ b/SDL-1.2.15-add_sdl_config_man.patch
@ -0,0 +1,90 @@
 diff -r 91ad7b43317a Makefile.in
 --- a/Makefile.in	Sun Jun 02 20:48:53 2013 +0600
 +++ b/Makefile.in	Wed Jun 19 10:34:27 2013 +0200
@@ -98,6 +98,11 @@
 	$(SHELL) $(auxdir)/mkinstalldirs $(DESTDIR)$(libdir)/pkgconfig
 	$(INSTALL) -m 644 sdl.pc $(DESTDIR)$(libdir)/pkgconfig
 install-man:
 +	$(SHELL) $(auxdir)/mkinstalldirs $(DESTDIR)$(mandir)/man1
 +	for src in $(srcdir)/docs/man1/*.1; do \
 +	    file=`echo $$src | sed -e 's|^.*/||'`; \
 +	    $(INSTALL) -m 644 $$src $(DESTDIR)$(mandir)/man1/$$file; \
 +	done
 	$(SHELL) $(auxdir)/mkinstalldirs $(DESTDIR)$(mandir)/man3
 	for src in $(srcdir)/docs/man3/*.3; do \
 	    file=`echo $$src | sed -e 's|^.*/||'`; \
@@ -120,6 +125,10 @@
 	rm -f $(DESTDIR)$(datadir)/aclocal/sdl.m4
 	rm -f $(DESTDIR)$(libdir)/pkgconfig/sdl.pc
 uninstall-man:
 +	for src in $(srcdir)/docs/man1/*.1; do \
 +	    file=`echo $$src | sed -e 's|^.*/||'`; \
 +	    rm -f $(DESTDIR)$(mandir)/man1/$$file; \
 +	done
 	for src in $(srcdir)/docs/man3/*.3; do \
 	    file=`echo $$src | sed -e 's|^.*/||'`; \
 	    rm -f $(DESTDIR)$(mandir)/man3/$$file; \
 diff -r 91ad7b43317a docs/man1/sdl-config.1
 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
 +++ b/docs/man1/sdl-config.1	Wed Jun 19 10:34:27 2013 +0200
@@ -0,0 +1,60 @@
 +.TH sdl-config 1 "2013-06-19" "SDL 1.2"
 +.SH NAME
 +sdl-config \- script to get information about the installed version of SDL
 +.SH SYNOPSIS
 +\fBsdl-config
 +[\~--prefix[=\fIDIR\fP]\~]
 +[\~--exec-prefix[=\fIDIR\fP]\~]
 +[\~--version\~] [\~--cflags\~] [\~--libs\~] [\~--static-libs\~]\fR
 +.SH DESCRIPTION
 +.B sdl-config
 +is a tool that is used to configure and determine the compiler and linker
 +flags that should be used to compile and link programs, and libraries, and
 +plugins that use SDL.  It is also used internally by the m4 macros that are
 +included with SDL.
 +.SH OPTIONS
 +.TP
 +.B --cflags
 +Print the compiler flags that are necessary to compile a program or library
 +that uses SDL.
 +.TP
 +.BI --exec-prefix= DIR
 +If specified, use
 +.I DIR
 +instead of the installation exec prefix that SDL was build with when computing
 +the output for the --exec-prefix option. This option must be specified before
 +any of the --cflags, and --libs options.
 +.TP
 +.B --libs
 +Print the linker flags that are necessary to link a program that uses SDL.
 +.TP
 +.BI --prefix= DIR
 +If specified, use DIR instead of the installation prefix that SDL was built
 +with when computing the output for the --prefix, and --exec-prefix options.
 +This option is also used for the exec prefix if --exec-prefix was not
 +specified. This option must be specified before any of the --cflags, and
 +--libs options.
 +.TP
 +.B --static-libs
 +Print the linker flags that are necessary to statically link a program that uses SDL.
 +.TP
 +.B --version
 +Prints the currently installed version of SDL on standard output.
 +.SH EXAMPLES
 +.TP
 +gcc -o main.o $(sdl-config --cflags) main.c
 +is how you might use
 +.B sdl-config
 +to compile a C source file for an executable program.
 +.TP
 +gcc -o my_app $(sdl-config --libs) main.o util.o
 +is how you might use
 +.B sdl-config
 +to link compiled objects into an executable program.
 +.SH AUTHOR
 +The Simple DirectMedia Layer (SDL) library was written by Sam Lantinga.
 +.PP
 +This manual page was written by Branden Robinson, originally for Progeny
 +Linux Systems, Inc., and the Debian Project.
 +.PP
 +This manual page was modified by Petr Pisar to match original SDL distribution.
--- a/SDL-1.2.15-const_XData32.patch
+++ b/SDL-1.2.15-const_XData32.patch
@ -0,0 +1,16 @@
 libX11-1.5.99.901 has changed prototype of _XData32
 <http://bugzilla.libsdl.org/show_bug.cgi?id=1769>
 diff -r b6b2829cd7ef src/video/x11/SDL_x11sym.h
 --- a/src/video/x11/SDL_x11sym.h	Wed Feb 27 15:20:31 2013 -0800
 +++ b/src/video/x11/SDL_x11sym.h	Wed Mar 27 16:07:23 2013 +0100
@@ -165,7 +165,7 @@
  */
 #ifdef LONG64
 SDL_X11_MODULE(IO_32BIT)
 -SDL_X11_SYM(int,_XData32,(Display *dpy,register long *data,unsigned len),(dpy,data,len),return)
 +SDL_X11_SYM(int,_XData32,(Display *dpy,register _Xconst long *data,unsigned len),(dpy,data,len),return)
 SDL_X11_SYM(void,_XRead32,(Display *dpy,register long *data,long len),(dpy,data,len),)
 #endif
--- a/SDL-1.2.15-ignore_insane_joystick_axis.patch
+++ b/SDL-1.2.15-ignore_insane_joystick_axis.patch
@ -0,0 +1,20 @@
 changeset:   6324:95abff7adcc2
 branch:      SDL-1.2
 parent:      6306:2b923729fd01
 user:        Ryan C. Gordon <icculus@icculus.org>
 date:        Sun Jun 03 04:49:25 2012 -0400
 summary:     Linux evdev: ignore joystick axis events if they aren't in a sane range.
 diff -r 2b923729fd01 -r 95abff7adcc2 src/joystick/linux/SDL_sysjoystick.c
 --- a/src/joystick/linux/SDL_sysjoystick.c	Sat May 12 23:32:51 2012 -0700
 +++ b/src/joystick/linux/SDL_sysjoystick.c	Sun Jun 03 04:49:25 2012 -0400
@@ -1106,6 +1106,9 @@
 				}
 				break;
 			    case EV_ABS:
 +				if (code > ABS_MISC) {
 +					break;
 +				}
 				switch (code) {
 				    case ABS_HAT0X:
 				    case ABS_HAT0Y:
--- a/SDL-1.2.15-no-default-backing-store.patch
+++ b/SDL-1.2.15-no-default-backing-store.patch
@ -0,0 +1,24 @@
 Do not harness backing store by default
 xorg-server 1.15 enables backing store if composite extension is enabled
 (default settings). Harnessing backing store through compositor leads to
 tearing effect.
 This patch reverts default harnessing backing store to conditional use if
 SDL_VIDEO_X11_BACKINGSTORE environment variable exists.
 <https://bugzilla.libsdl.org/show_bug.cgi?id=2383>
 <https://bugzilla.redhat.com/show_bug.cgi?id=1073057>
 diff -up SDL-1.2.15/src/video/x11/SDL_x11video.c.jx SDL-1.2.15/src/video/x11/SDL_x11video.c
 --- SDL-1.2.15/src/video/x11/SDL_x11video.c.jx	2012-01-19 01:30:06.000000000 -0500
 +++ SDL-1.2.15/src/video/x11/SDL_x11video.c	2014-03-04 14:39:34.691545549 -0500
@@ -1088,7 +1088,7 @@ static int X11_CreateWindow(_THIS, SDL_S
 		}
 	}
 -#if 0 /* This is an experiment - are the graphics faster now? - nope. */
 +#if 1 /* This is an experiment - are the graphics faster now? - nope. */
 	if ( SDL_getenv("SDL_VIDEO_X11_BACKINGSTORE") )
 #endif
 	/* Cache the window in the server, when possible */
--- a/SDL-1.2.15-vec_perm-ppc64le.patch
+++ b/SDL-1.2.15-vec_perm-ppc64le.patch
@ -0,0 +1,87 @@
 Correct vec_perm() application on little-endian 64-bit PowerPC
 The LE transformation for vec_perm has an implicit assumption that the
 permutation is being used to reorder vector elements (in this case 4-byte
 integer word elements), not to reorder bytes within those elements.  Although
 this is legal behavior, it is not anticipated by the transformation performed
 by the compilers.
 This causes pygame-1.9.1 test failure on PPC64LE because blitted pixmaps are
 corrupted there due to how SDL uses vec_perm().
 <https://bugzilla.redhat.com/show_bug.cgi?id=1392465>
 --- SDL-1.2.15/src/video/SDL_blit_N.c.ori	2017-09-04 05:56:17.759347525 -0400
 +++ SDL-1.2.15/src/video/SDL_blit_N.c	2017-09-06 05:36:20.570789610 -0400
@@ -146,6 +146,32 @@ static vector unsigned char calc_swizzle
     return(vswiz);
 }
 +/* reorder bytes for PowerPC little endian */
 +static vector unsigned char reorder_ppc64le_vec(vector unsigned char vpermute)
 +{
 +    /* The result vector of calc_swizzle32 reorder bytes using vec_perm.
 +       The LE transformation for vec_perm has an implicit assumption
 +       that the permutation is being used to reorder vector elements,
 +       not to reorder bytes within those elements.  
 +       Unfortunatly the result order is not the expected one for powerpc
 +       little endian when the two first vector parameters of vec_perm are
 +       not of type 'vector char'. This is because the numbering from the
 +       left for BE, and numbering from the right for LE, produces a
 +       different interpretation of what the odd and even lanes are.
 +       Refer to fedora bug 1392465
 +     */
 +
 +    const vector unsigned char ppc64le_reorder = VECUINT8_LITERAL(
 +                                      0x01, 0x00, 0x03, 0x02,
 +                                      0x05, 0x04, 0x07, 0x06,
 +                                      0x09, 0x08, 0x0B, 0x0A,
 +                                      0x0D, 0x0C, 0x0F, 0x0E );
 +
 +    vector unsigned char vswiz_ppc64le;
 +    vswiz_ppc64le = vec_perm(vpermute, vpermute, ppc64le_reorder);
 +    return(vswiz_ppc64le);
 +}
 +
 static void Blit_RGB888_RGB565(SDL_BlitInfo *info);
 static void Blit_RGB888_RGB565Altivec(SDL_BlitInfo *info) {
     int height = info->d_height;
@@ -631,6 +657,12 @@ static void Blit32to32KeyAltivec(SDL_Bli
                 vsel = (vector unsigned char)vec_and(vs, vrgbmask);
                 vsel = (vector unsigned char)vec_cmpeq(vs, vckey);
                 /* permute the src vec to the dest format */
 +
 +#if defined(__powerpc__) && (SDL_BYTEORDER == SDL_LIL_ENDIAN)
 +            /* reorder bytes for PowerPC little endian */
 +            vpermute = reorder_ppc64le_vec(vpermute);
 +#endif
 +
                 vs = vec_perm(vs, valpha, vpermute);
                 /* load the destination vec */
                 vd = vec_ld(0, dstp);
@@ -704,6 +736,12 @@ static void ConvertAltivec32to32_noprefe
             src += 4;
             width -= 4;
             vbits = vec_perm(vbits, voverflow, valigner);  /* src is ready. */
 +
 +#if defined(__powerpc__) && (SDL_BYTEORDER == SDL_LIL_ENDIAN)
 +            /* reorder bytes for PowerPC little endian */
 +            vpermute = reorder_ppc64le_vec(vpermute);
 +#endif
 +
             vbits = vec_perm(vbits, vzero, vpermute);  /* swizzle it. */
             vec_st(vbits, 0, dst);  /* store it back out. */
             dst += 4;
@@ -786,6 +824,12 @@ static void ConvertAltivec32to32_prefetc
             src += 4;
             width -= 4;
             vbits = vec_perm(vbits, voverflow, valigner);  /* src is ready. */
 +
 +#if defined(__powerpc__) && (SDL_BYTEORDER == SDL_LIL_ENDIAN) 
 +            /* reorder bytes for PowerPC little endian */
 +            vpermute = reorder_ppc64le_vec(vpermute);
 +#endif
 +
             vbits = vec_perm(vbits, vzero, vpermute);  /* swizzle it. */
             vec_st(vbits, 0, dst);  /* store it back out. */
             dst += 4;
--- a/SDL-1.2.15_repackaged.tar.gz
+++ b/SDL-1.2.15_repackaged.tar.gz
--- a/SDL.spec
+++ b/SDL.spec
@ -0,0 +1,111 @@
 Name:       SDL
 Summary:    A cross-platform multimedia library
 Version:    1.2.15
 Release:    34
 License:    LGPLv2+
 URL:        http://www.libsdl.org/
 # These files are from fedora
 Source0:    %{name}-%{version}_repackaged.tar.gz
 Source1:    SDL_config.h
 Source2:    repackage.sh
 Patch0:     SDL-1.2.12-multilib.patch
 Patch1:     SDL-1.2.10-GrabNotViewable.patch
 Patch2:     SDL-1.2.15-const_XData32.patch
 Patch3:     SDL-1.2.15-add_sdl_config_man.patch
 Patch4:     SDL-1.2.15-ignore_insane_joystick_axis.patch
 Patch5:     SDL-1.2.15-no-default-backing-store.patch
 Patch6:     SDL-1.2.15-SDL_EnableUNICODE_drops_keyboard_events.patch
 Patch7:     SDL-1.2.15-vec_perm-ppc64le.patch
 # These patches are backport from SDL community
 Patch9000: CVE-2019-7637.patch
 Patch9001: CVE-2019-7636.patch
 Patch9002: CVE-2019-7635_1.patch
 Patch9003: CVE-2019-7635_2.patch
 Patch9004: CVE-2019-7573_CVE-2019-7576.patch
 Patch9005: CVE-2019-7578.patch
 Patch9006: CVE-2019-7577.patch
 BuildRequires:  git alsa-lib-devel gdb-headless
 %description
 Simple DirectMedia Layer(SDL) is a cross-platform development library designed\
 to provide low level access to audio, keyboard, mouse, joystick, and graphics\
 hardware via OpenGL and Direct3D. It is used by video playback software, emulators,\
 and popular games including Valve's award winning catalog and many Humble Bundle games.\
 %package devel
 Summary:	Development files for %{name}
 Provides:	%{name}-static
 Obsoletes:	%{name}-static
 Requires:	%{name} = %{version}-%{release}
 Requires:	alsa-lib-devel mesa-libGL-devel mesa-libGLU-devel
 Requires:	libX11-devel libXext-devel libXrandr-devel libXrender-devel
 %description devel
 Libraries and header files of %{name} are all in the %{name}-devel package.
 %package        help
 Summary:        Help manual for %{name}
 %description    help
 The %{name}-help package conatins man manual etc
 %prep
 %autosetup -n %{name}-%{version} -p1 -Sgit
 for F in CREDITS; do
    iconv -f iso8859-1 -t utf-8 < "$F" > "${F}.utf"
    touch --reference "$F" "${F}.utf"
    mv "${F}.utf" "$F"
 done
 sed -i -e 's/.*AM_PATH_ESD.*//' configure.in
 cp -p %{_datadir}/automake-*/config.{sub,guess} build-scripts
 %build
 aclocal
 libtoolize
 autoconf
 %configure \
    --disable-video-svga \
    --disable-video-ggi \
    --disable-video-aalib \
    --enable-sdl-dlopen \
    --disable-arts \
    --disable-esd \
    --disable-nas \
    --enable-pulseaudio-shared \
    --enable-alsa \
    --disable-video-ps3 \
    --disable-rpath
 %make_build
 %install
 %make_install
 # Rename SDL_config.h to SDL_config-<arch>.h to avoid file conflicts on
 # multilib systems and install SDL_config.h wrapper
 mv %{buildroot}/%{_includedir}/SDL/SDL_config.h %{buildroot}/%{_includedir}/SDL/SDL_config-%{_arch}.h
 install -m644 %{SOURCE1} %{buildroot}/%{_includedir}/SDL/SDL_config.h
 rm -f %{buildroot}%{_libdir}/*.la
 %files
 %license COPYING
 %doc BUGS CREDITS README-SDL.txt
 %{_libdir}/lib*.so.*
 %files devel
 %doc README docs.html docs/html docs/index.html TODO WhatsNew
 %{_bindir}/*-config
 %{_libdir}/lib*.so
 %{_libdir}/pkgconfig/sdl.pc
 %{_includedir}/SDL
 %{_datadir}/aclocal/*
 %{_libdir}/lib*.a
 %files help
 %{_mandir}/man1/*
 %{_mandir}/man3/SDL*.3*
 %changelog
 * Wed Nov 13 2019 openEuler Buildteam <buildteam@openeuler.org> - 1.2.15-34
 - Package init
--- a/SDL_config.h
+++ b/SDL_config.h
@ -0,0 +1,80 @@
 /*
    SDL - Simple DirectMedia Layer
    Copyright (C) 1997-2006 Sam Lantinga
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License as published by the Free Software Foundation; either
    version 2.1 of the License, or (at your option) any later version.
    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    Lesser General Public License for more details.
    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
    Sam Lantinga
    slouken@libsdl.org
 */
 /*
 * This SDL_config.h is a wrapper include file for the original SDL_config.h, 
 * which has been renamed to SDL_config-<arch>.h. There are conflicts for the 
 * original SDL_config.h on multilib systems, which result from arch-specific
 * configuration options. Please do not use the arch-specific file directly.
 *
 * Copyright (C) 2006 Red Hat, Inc.
 * Thomas Woerner <twoerner@redhat.com>
 */
 #ifdef SDL_config_wrapper_h
 #error "SDL_config_wrapper_h should not be defined!"
 #endif
 #define SDL_config_wrapper_h
 #if defined(__i386__)
 #include "SDL_config-i386.h"
 #elif defined(__ia64__)
 #include "SDL_config-ia64.h"
 #elif defined(__powerpc64__)
 #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
 #include "SDL_config-ppc64.h"
 #else
 #include "SDL_config-ppc64le.h"
 #endif
 #elif defined(__powerpc__)
 #include "SDL_config-ppc.h"
 #elif defined(__s390x__)
 #include "SDL_config-s390x.h"
 #elif defined(__s390__)
 #include "SDL_config-s390.h"
 #elif defined(__x86_64__)
 #include "SDL_config-x86_64.h"
 #elif defined(__arm__)
 #include "SDL_config-arm.h"
 #elif defined(__alpha__)
 #include "SDL_config-alpha.h"
 #elif defined(__sparc__) && defined (__arch64__)
 #include "SDL_config-sparc64.h"
 #elif defined(__sparc__)
 #include "SDL_config-sparc.h"
 #elif defined(__aarch64__)
 #include "SDL_config-aarch64.h"
 #elif defined(__mips64) && defined(__MIPSEL__)
 #include "SDL_config-mips64el.h"
 #elif defined(__mips64)
 #include "SDL_config-mips64.h"
 #elif defined(__mips) && defined(__MIPSEL__)
 #include "SDL_config-mipsel.h"
 #elif defined(__mips)
 #include "SDL_config-mips.h"
 #elif defined(__riscv) && defined(__riscv_xlen) && __riscv_xlen == 64
 #include "SDL_config-riscv64.h"
 #else
 #error "The SDL-devel package is not usable with the architecture."
 #endif
 #undef SDL_config_wrapper_h
--- a/repackage.sh
+++ b/repackage.sh
@ -0,0 +1,59 @@
 #!/bin/bash
 #
 # Copyright (C) 2010 Red Hat, Inc.
 # Authors:
 # Thomas Woerner <twoerner@redhat.com>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 2 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 version=$1
 [ -z "$version" ] && { echo "Usage: $0 <version>"; exit 1; }
 # files to be removed without the main SDL-<version>/ prefix
 declare -a REMOVE
 REMOVE[${#REMOVE[*]}]="symbian.zip"
 # no changes below this line should be needed
 orig="SDL-${version}"
 orig_tgz="${orig}.tar.gz"
 repackaged="${orig}_repackaged"
 repackaged_tar="${repackaged}.tar"
 repackaged_tgz="${repackaged_tar}.gz"
 # pre checks
 [ ! -f "${orig_tgz}" ] && { echo "ERROR: ${orig_tgz} does not exist"; exit 1; }
 [ -f "${repackaged_tgz}" ] && { echo "ERROR: ${repackaged_tgz} already exist"; exit 1; }
 # repackage
 failure=0
 gzip -dc "${orig_tgz}" > "${repackaged_tar}"
 for file in "${REMOVE[@]}"; do
    tar -f "${repackaged_tar}" --delete "${orig}/${file}" >> repackage.log
    [ $? != 0 ] && { echo "ERROR: Could not remove file ${orig}/${file} from archive."; failure=1; } || echo "Removed ${orig}/${file} from archive."
 done
 [ $failure != 0 ] && { echo "See repackage.log for details."; exit 1; }
 gzip -9 -n "${repackaged_tar}"
 # post checks
 RET=0
 for file in "${REMOVE[@]}"; do
    found=$(tar -ztvf "${repackaged_tgz}" | grep "${file}")
    [ -n "$found" ] && { echo "ERROR: file ${file} is still in the repackaged archive."; RET=1; }
 done
 [ $RET == 0 ] && echo "Sucessfully repackaged ${orig}: ${repackaged_tgz}"
 exit $RET