From 94c3dacdbfd7fbe42d04096366fbbb1155a575e2 Mon Sep 17 00:00:00 2001
From: Ozkan Sezer <[EMAIL REDACTED]>
Date: Thu, 23 Apr 2026 11:20:40 -0700
Subject: [PATCH] tga: reject images with zero width or height
When SDL_CreateSurface() is called with w=0 or h=0 it may return a
non-NULL surface but with a NULL pixels pointer (zero-size allocation).
Subsequent code at IMG_LoadTGA_IO accesses img->pixels unconditionally,
resulting in undefined behavior: UBSan reports "applying zero offset to
null pointer" for the expression (Uint8*)img->pixels + (h-1)*img->pitch
when pitch is 0.
Reject zero-dimension images early before creating the surface.
CWE-476 (NULL Pointer Dereference)
Found by: NORAI fuzzer (libFuzzer + UBSan)
PoC: poc_sdl007_tga_null_pixels.tga
(manual backport of commit 9f1318e7c112493fcd224eafe8809d4001d1bb33)
---
IMG_tga.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/IMG_tga.c b/IMG_tga.c
index d02018ff0..c8c12d9e7 100644
--- a/IMG_tga.c
+++ b/IMG_tga.c
@@ -198,6 +198,10 @@ SDL_Surface *IMG_LoadTGA_RW(SDL_RWops *src)
w = LE16(hdr.width);
h = LE16(hdr.height);
+ if(w == 0 || h == 0) {
+ error = "TGA image with zero width or height";
+ goto error;
+ }
img = SDL_CreateRGBSurface(SDL_SWSURFACE, w, h,
bpp * 8,
rmask, gmask, bmask, amask);