28 changed files with 2363 additions and 1 deletions
--- a/.SDL.metadata
+++ b/.SDL.metadata
@ -0,0 +1 @@
 61a0c4976ecc88d1101f1d03105089588d167a40 SOURCES/SDL-1.2.15_repackaged.tar.gz
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1 @@
 SOURCES/SDL-1.2.15_repackaged.tar.gz
--- a/SOURCES/0001-CVE-2019-7572-Fix-a-buffer-overread-in-IMA_ADPCM_nib.patch
+++ b/SOURCES/0001-CVE-2019-7572-Fix-a-buffer-overread-in-IMA_ADPCM_nib.patch
@ -0,0 +1,61 @@
 From 4b4cac39ba7988df9d8def32360dd842b707ba74 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Sat, 8 Jun 2019 17:57:43 -0700
 Subject: [PATCH 01/11] CVE-2019-7572: Fix a buffer overread in
 IMA_ADPCM_nibble If an IMA ADPCM block contained an initial index out of step
 table range (loaded in IMA_ADPCM_decode()), IMA_ADPCM_nibble() blindly used
 this bogus value and that lead to a buffer overread.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This patch fixes it by moving clamping the index value at the
 beginning of IMA_ADPCM_nibble() function instead of the end after
 an update.
 CVE-2019-7572
 https://bugzilla.libsdl.org/show_bug.cgi?id=4495
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 --HG--
 branch : SDL-1.2
 ---
 src/audio/SDL_wave.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)
 diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c
 index b4ad6c787..ba1fb5252 100644
 --- a/src/audio/SDL_wave.c
 +++ b/src/audio/SDL_wave.c
@@ -264,6 +264,14 @@ static Sint32 IMA_ADPCM_nibble(struct IMA_ADPCM_decodestate *state,Uint8 nybble)
 	};
 	Sint32 delta, step;
 +	/* Clamp index value. The inital value can be invalid. */
 +	if ( state->index > 88 ) {
 +		state->index = 88;
 +	} else
 +	if ( state->index < 0 ) {
 +		state->index = 0;
 +	}
 +
 	/* Compute difference and new sample value */
 	step = step_table[state->index];
 	delta = step >> 3;
@@ -275,12 +283,6 @@ static Sint32 IMA_ADPCM_nibble(struct IMA_ADPCM_decodestate *state,Uint8 nybble)
 	/* Update index value */
 	state->index += index_table[nybble];
 -	if ( state->index > 88 ) {
 -		state->index = 88;
 -	} else
 -	if ( state->index < 0 ) {
 -		state->index = 0;
 -	}
 	/* Clamp output sample */
 	if ( state->sample > max_audioval ) {
 -- 
 2.21.0
--- a/SOURCES/0001-Fixed-bug-4108-Missing-break-statements-in-SDL_CDRes.patch
+++ b/SOURCES/0001-Fixed-bug-4108-Missing-break-statements-in-SDL_CDRes.patch
@ -0,0 +1,41 @@
 From b8dab2d1dae1f6fb0f2b466e2b26645d072b9aaa Mon Sep 17 00:00:00 2001
 From: Sam Lantinga <slouken@libsdl.org>
 Date: Sat, 24 Mar 2018 10:15:42 -0700
 Subject: [PATCH] Fixed bug 4108 - Missing break statements in SDL_CDResume and
 SDL_CDStop
 Ozkan Sezer
 Two break statements are missing in SDL_cdrom.c:SDL_CDResume()
 and SDL_CDStop(), which negate the returned code from driver
 and always return 0.  The following patch adds those breaks.
 --HG--
 branch : SDL-1.2
 ---
 src/cdrom/SDL_cdrom.c | 2 ++
 1 file changed, 2 insertions(+)
 diff --git a/src/cdrom/SDL_cdrom.c b/src/cdrom/SDL_cdrom.c
 index 8f91bb1b3..fac2437e5 100644
 --- a/src/cdrom/SDL_cdrom.c
 +++ b/src/cdrom/SDL_cdrom.c
@@ -285,6 +285,7 @@ int SDL_CDResume(SDL_CD *cdrom)
 	switch (status) {
 		case CD_PAUSED:
 			retval = SDL_CDcaps.Resume(cdrom);
 +			break;
 		default:
 			retval = 0;
 			break;
@@ -307,6 +308,7 @@ int SDL_CDStop(SDL_CD *cdrom)
 		case CD_PLAYING:
 		case CD_PAUSED:
 			retval = SDL_CDcaps.Stop(cdrom);
 +			break;
 		default:
 			retval = 0;
 			break;
 -- 
 2.17.1
--- a/SOURCES/0001-fix-small-errors-detected-by-coverity.patch
+++ b/SOURCES/0001-fix-small-errors-detected-by-coverity.patch
@ -0,0 +1,67 @@
 From a976b037b63d8de9ed0eb920238ac4211b649408 Mon Sep 17 00:00:00 2001
 From: Wim Taymans <wtaymans@redhat.com>
 Date: Mon, 29 Apr 2019 15:50:39 +0200
 Subject: [PATCH] fix small errors detected by coverity
 ---
 src/video/SDL_surface.c        | 2 +-
 src/video/fbcon/SDL_fbevents.c | 2 +-
 src/video/fbcon/SDL_fbmatrox.c | 2 ++
 3 files changed, 4 insertions(+), 2 deletions(-)
 diff --git a/src/video/SDL_surface.c b/src/video/SDL_surface.c
 index 0f3ad12c4..0386cb3fb 100644
 --- a/src/video/SDL_surface.c
 +++ b/src/video/SDL_surface.c
@@ -116,6 +116,7 @@ SDL_Surface * SDL_CreateRGBSurface (Uint32 flags,
 	surface->locked = 0;
 	surface->map = NULL;
 	surface->unused1 = 0;
 +	surface->refcount = 1;
 	SDL_SetClipRect(surface, NULL);
 	SDL_FormatChanged(surface);
@@ -142,7 +143,6 @@ SDL_Surface * SDL_CreateRGBSurface (Uint32 flags,
 	}
 	/* The surface is ready to go */
 -	surface->refcount = 1;
 #ifdef CHECK_LEAKS
 	++surfaces_allocated;
 #endif
 diff --git a/src/video/fbcon/SDL_fbevents.c b/src/video/fbcon/SDL_fbevents.c
 index 5e369a4a8..dd7413df9 100644
 --- a/src/video/fbcon/SDL_fbevents.c
 +++ b/src/video/fbcon/SDL_fbevents.c
@@ -575,7 +575,7 @@ int FB_OpenMouse(_THIS)
 	/* ELO TOUCHSCREEN SUPPORT */
 -	if ( mousedrv && (SDL_strcmp(mousedrv, "ELO") == 0) ) {
 +	if ( mousedrv && (SDL_strcmp(mousedrv, "ELO") == 0) && mousedev ) {
 		mouse_fd = open(mousedev, O_RDWR);
 		if ( mouse_fd >= 0 ) {
 			if(eloInitController(mouse_fd)) {
 diff --git a/src/video/fbcon/SDL_fbmatrox.c b/src/video/fbcon/SDL_fbmatrox.c
 index 04b90b05d..4e3da4f84 100644
 --- a/src/video/fbcon/SDL_fbmatrox.c
 +++ b/src/video/fbcon/SDL_fbmatrox.c
@@ -80,6 +80,7 @@ static int FillHWRect(_THIS, SDL_Surface *dst, SDL_Rect *rect, Uint32 color)
 	switch (dst->format->BytesPerPixel) {
 	    case 1:
 		color |= (color<<8);
 +		/* fallthrough */
 	    case 2:
 		color |= (color<<16);
 		break;
@@ -191,6 +192,7 @@ static int HWAccelBlit(SDL_Surface *src, SDL_Rect *srcrect,
 		switch (dst->format->BytesPerPixel) {
 		    case 1:
 			colorkey |= (colorkey<<8);
 +			/* fallthrough */
 		    case 2:
 			colorkey |= (colorkey<<16);
 			break;
 -- 
 2.20.1
--- a/SOURCES/0002-CVE-2019-7578-Fix-a-buffer-overread-in-InitIMA_ADPCM.patch
+++ b/SOURCES/0002-CVE-2019-7578-Fix-a-buffer-overread-in-InitIMA_ADPCM.patch
@ -0,0 +1,69 @@
 From 210e68f70a5a007b0664239aa557e6b9d1b3e830 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Sat, 8 Jun 2019 18:02:09 -0700
 Subject: [PATCH 02/11] CVE-2019-7578: Fix a buffer overread in InitIMA_ADPCM
 If IMA ADPCM format chunk was too short, InitIMA_ADPCM() parsing it could
 read past the end of chunk data. This patch fixes it.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 CVE-2019-7578
 https://bugzilla.libsdl.org/show_bug.cgi?id=4494
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 --HG--
 branch : SDL-1.2
 ---
 src/audio/SDL_wave.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)
 diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c
 index ba1fb5252..21ee4dc3c 100644
 --- a/src/audio/SDL_wave.c
 +++ b/src/audio/SDL_wave.c
@@ -222,11 +222,12 @@ static struct IMA_ADPCM_decoder {
 	struct IMA_ADPCM_decodestate state[2];
 } IMA_ADPCM_state;
 -static int InitIMA_ADPCM(WaveFMT *format)
 +static int InitIMA_ADPCM(WaveFMT *format, int length)
 {
 -	Uint8 *rogue_feel;
 +	Uint8 *rogue_feel, *rogue_feel_end;
 	/* Set the rogue pointer to the IMA_ADPCM specific data */
 +	if (length < sizeof(*format)) goto too_short;
 	IMA_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding);
 	IMA_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels);
 	IMA_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency);
@@ -235,11 +236,16 @@ static int InitIMA_ADPCM(WaveFMT *format)
 	IMA_ADPCM_state.wavefmt.bitspersample =
 					 SDL_SwapLE16(format->bitspersample);
 	rogue_feel = (Uint8 *)format+sizeof(*format);
 +	rogue_feel_end = (Uint8 *)format + length;
 	if ( sizeof(*format) == 16 ) {
 		rogue_feel += sizeof(Uint16);
 	}
 +	if (rogue_feel + 2 > rogue_feel_end) goto too_short;
 	IMA_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]);
 	return(0);
 +too_short:
 +	SDL_SetError("Unexpected length of a chunk with an IMA ADPCM format");
 +	return(-1);
 }
 static Sint32 IMA_ADPCM_nibble(struct IMA_ADPCM_decodestate *state,Uint8 nybble)
@@ -471,7 +477,7 @@ SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
 			break;
 		case IMA_ADPCM_CODE:
 			/* Try to understand this */
 -			if ( InitIMA_ADPCM(format) < 0 ) {
 +			if ( InitIMA_ADPCM(format, lenread) < 0 ) {
 				was_error = 1;
 				goto done;
 			}
 -- 
 2.21.0
--- a/SOURCES/0003-CVE-2019-7574-Fix-a-buffer-overread-in-IMA_ADPCM_dec.patch
+++ b/SOURCES/0003-CVE-2019-7574-Fix-a-buffer-overread-in-IMA_ADPCM_dec.patch
@ -0,0 +1,73 @@
 From db0282cbe00a64cc65ba445ea21928d72dc26d97 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Mon, 10 Jun 2019 08:50:59 -0700
 Subject: [PATCH 03/11] CVE-2019-7574: Fix a buffer overread in
 IMA_ADPCM_decode If data chunk was shorter than expected based on a WAV
 format definition, IMA_ADPCM_decode() tried to read past the data chunk
 buffer. This patch fixes it.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 CVE-2019-7574
 https://bugzilla.libsdl.org/show_bug.cgi?id=4496
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 --HG--
 branch : SDL-1.2
 ---
 src/audio/SDL_wave.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)
 diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c
 index 21ee4dc3c..66f804421 100644
 --- a/src/audio/SDL_wave.c
 +++ b/src/audio/SDL_wave.c
@@ -331,7 +331,7 @@ static void Fill_IMA_ADPCM_block(Uint8 *decoded, Uint8 *encoded,
 static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 {
 	struct IMA_ADPCM_decodestate *state;
 -	Uint8 *freeable, *encoded, *decoded;
 +	Uint8 *freeable, *encoded, *encoded_end, *decoded;
 	Sint32 encoded_len, samplesleft;
 	unsigned int c, channels;
@@ -347,6 +347,7 @@ static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	/* Allocate the proper sized output buffer */
 	encoded_len = *audio_len;
 	encoded = *audio_buf;
 +	encoded_end = encoded + encoded_len;
 	freeable = *audio_buf;
 	*audio_len = (encoded_len/IMA_ADPCM_state.wavefmt.blockalign) * 
 				IMA_ADPCM_state.wSamplesPerBlock*
@@ -362,6 +363,7 @@ static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	while ( encoded_len >= IMA_ADPCM_state.wavefmt.blockalign ) {
 		/* Grab the initial information for this block */
 		for ( c=0; c<channels; ++c ) {
 +			if (encoded + 4 > encoded_end) goto invalid_size;
 			/* Fill the state information for this block */
 			state[c].sample = ((encoded[1]<<8)|encoded[0]);
 			encoded += 2;
@@ -384,6 +386,7 @@ static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 		samplesleft = (IMA_ADPCM_state.wSamplesPerBlock-1)*channels;
 		while ( samplesleft > 0 ) {
 			for ( c=0; c<channels; ++c ) {
 +				if (encoded + 4 > encoded_end) goto invalid_size;
 				Fill_IMA_ADPCM_block(decoded, encoded,
 						c, channels, &state[c]);
 				encoded += 4;
@@ -395,6 +398,10 @@ static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	}
 	SDL_free(freeable);
 	return(0);
 +invalid_size:
 +	SDL_SetError("Unexpected chunk length for an IMA ADPCM decoder");
 +	SDL_free(freeable);
 +	return(-1);
 }
 SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
 -- 
 2.21.0
--- a/SOURCES/0004-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_deco.patch
+++ b/SOURCES/0004-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_deco.patch
@ -0,0 +1,76 @@
 From d5ec943db7d51fccd7230c9df0c7a2e46d611f50 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Mon, 10 Jun 2019 08:54:11 -0700
 Subject: [PATCH 04/11] CVE-2019-7577: Fix a buffer overread in MS_ADPCM_decode
 If RIFF/WAV data chunk length is shorter then expected for an audio format
 defined in preceeding RIFF/WAV format headers, a buffer overread can happen.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This patch fixes it by checking a MS ADPCM data to be decoded are not
 past the initialized buffer.
 CVE-2019-7577
 Reproducer: https://bugzilla.libsdl.org/show_bug.cgi?id=4492
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 --HG--
 branch : SDL-1.2
 ---
 src/audio/SDL_wave.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)
 diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c
 index 66f804421..6c6eb14eb 100644
 --- a/src/audio/SDL_wave.c
 +++ b/src/audio/SDL_wave.c
@@ -115,7 +115,7 @@ static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state,
 static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 {
 	struct MS_ADPCM_decodestate *state[2];
 -	Uint8 *freeable, *encoded, *decoded;
 +	Uint8 *freeable, *encoded, *encoded_end, *decoded;
 	Sint32 encoded_len, samplesleft;
 	Sint8 nybble, stereo;
 	Sint16 *coeff[2];
@@ -124,6 +124,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	/* Allocate the proper sized output buffer */
 	encoded_len = *audio_len;
 	encoded = *audio_buf;
 +	encoded_end = encoded + encoded_len;
 	freeable = *audio_buf;
 	*audio_len = (encoded_len/MS_ADPCM_state.wavefmt.blockalign) * 
 				MS_ADPCM_state.wSamplesPerBlock*
@@ -141,6 +142,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	state[1] = &MS_ADPCM_state.state[stereo];
 	while ( encoded_len >= MS_ADPCM_state.wavefmt.blockalign ) {
 		/* Grab the initial information for this block */
 +		if (encoded + 7 + (stereo ? 7 : 0) > encoded_end) goto too_short;
 		state[0]->hPredictor = *encoded++;
 		if ( stereo ) {
 			state[1]->hPredictor = *encoded++;
@@ -188,6 +190,8 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 		samplesleft = (MS_ADPCM_state.wSamplesPerBlock-2)*
 					MS_ADPCM_state.wavefmt.channels;
 		while ( samplesleft > 0 ) {
 +			if (encoded + 1 > encoded_end) goto too_short;
 +
 			nybble = (*encoded)>>4;
 			new_sample = MS_ADPCM_nibble(state[0],nybble,coeff[0]);
 			decoded[0] = new_sample&0xFF;
@@ -209,6 +213,10 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	}
 	SDL_free(freeable);
 	return(0);
 +too_short:
 +	SDL_SetError("Too short chunk for a MS ADPCM decoder");
 +	SDL_free(freeable);
 +	return(-1);
 }
 struct IMA_ADPCM_decodestate {
 -- 
 2.21.0
--- a/SOURCES/0005-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch
+++ b/SOURCES/0005-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch
@ -0,0 +1,58 @@
 From 06d20617d0d5bb89a6caf5f2201c93baf03c43c2 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Mon, 10 Jun 2019 08:54:29 -0700
 Subject: [PATCH 05/11] CVE-2019-7577: Fix a buffer overread in MS_ADPCM_nibble
 and MS_ADPCM_decode If a chunk of RIFF/WAV file with MS ADPCM encoding
 contains an invalid predictor (a valid predictor's value is between 0 and 6
 inclusive), a buffer overread can happen when the predictor is used as an
 index into an array of MS ADPCM coefficients.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 The overead happens when indexing MS_ADPCM_state.aCoeff[] array in
 MS_ADPCM_decode() and later when dereferencing a coef pointer in
 MS_ADPCM_nibble().
 This patch fixes it by checking the MS ADPCM predictor values fit
 into the valid range.
 CVE-2019-7577
 Reproducer: https://bugzilla.libsdl.org/show_bug.cgi?id=4492
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 --HG--
 branch : SDL-1.2
 ---
 src/audio/SDL_wave.c | 7 +++++++
 1 file changed, 7 insertions(+)
 diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c
 index 6c6eb14eb..3eedd20a1 100644
 --- a/src/audio/SDL_wave.c
 +++ b/src/audio/SDL_wave.c
@@ -147,6 +147,9 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 		if ( stereo ) {
 			state[1]->hPredictor = *encoded++;
 		}
 +		if (state[0]->hPredictor >= 7 || state[1]->hPredictor >= 7) {
 +			goto invalid_predictor;
 +		}
 		state[0]->iDelta = ((encoded[1]<<8)|encoded[0]);
 		encoded += sizeof(Sint16);
 		if ( stereo ) {
@@ -217,6 +220,10 @@ too_short:
 	SDL_SetError("Too short chunk for a MS ADPCM decoder");
 	SDL_free(freeable);
 	return(-1);
 +invalid_predictor:
 +	SDL_SetError("Invalid predictor value for a MS ADPCM decoder");
 +	SDL_free(freeable);
 +	return(-1);
 }
 struct IMA_ADPCM_decodestate {
 -- 
 2.21.0
--- a/SOURCES/0006-CVE-2019-7572-Fix-a-buffer-overwrite-in-IMA_ADPCM_de.patch
+++ b/SOURCES/0006-CVE-2019-7572-Fix-a-buffer-overwrite-in-IMA_ADPCM_de.patch
@ -0,0 +1,66 @@
 From b637e14f849130449544c8899aed716a2f049b75 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Mon, 10 Jun 2019 08:57:11 -0700
 Subject: [PATCH 06/11] CVE-2019-7572: Fix a buffer overwrite in
 IMA_ADPCM_decode If data chunk was longer than expected based on a WAV format
 definition, IMA_ADPCM_decode() tried to write past the output buffer. This
 patch fixes it.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 Based on patch from
 <https://bugzilla.libsdl.org/show_bug.cgi?id=4496>.
 CVE-2019-7572
 https://bugzilla.libsdl.org/show_bug.cgi?id=4495
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 --HG--
 branch : SDL-1.2
 ---
 src/audio/SDL_wave.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c
 index 3eedd20a1..4159eb710 100644
 --- a/src/audio/SDL_wave.c
 +++ b/src/audio/SDL_wave.c
@@ -346,7 +346,7 @@ static void Fill_IMA_ADPCM_block(Uint8 *decoded, Uint8 *encoded,
 static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 {
 	struct IMA_ADPCM_decodestate *state;
 -	Uint8 *freeable, *encoded, *encoded_end, *decoded;
 +	Uint8 *freeable, *encoded, *encoded_end, *decoded, *decoded_end;
 	Sint32 encoded_len, samplesleft;
 	unsigned int c, channels;
@@ -373,6 +373,7 @@ static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 		return(-1);
 	}
 	decoded = *audio_buf;
 +	decoded_end = decoded + *audio_len;
 	/* Get ready... Go! */
 	while ( encoded_len >= IMA_ADPCM_state.wavefmt.blockalign ) {
@@ -392,6 +393,7 @@ static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 			}
 			/* Store the initial sample we start with */
 +			if (decoded + 2 > decoded_end) goto invalid_size;
 			decoded[0] = (Uint8)(state[c].sample&0xFF);
 			decoded[1] = (Uint8)(state[c].sample>>8);
 			decoded += 2;
@@ -402,6 +404,8 @@ static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 		while ( samplesleft > 0 ) {
 			for ( c=0; c<channels; ++c ) {
 				if (encoded + 4 > encoded_end) goto invalid_size;
 +				if (decoded + 4 * 4 * channels > decoded_end)
 +					goto invalid_size;
 				Fill_IMA_ADPCM_block(decoded, encoded,
 						c, channels, &state[c]);
 				encoded += 4;
 -- 
 2.21.0
--- a/SOURCES/0007-CVE-2019-7573-CVE-2019-7576-Fix-buffer-overreads-in-.patch
+++ b/SOURCES/0007-CVE-2019-7573-CVE-2019-7576-Fix-buffer-overreads-in-.patch
@ -0,0 +1,84 @@
 From 45ef356d8c01a3941286b35b90eb319959f20f2c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Mon, 10 Jun 2019 09:06:23 -0700
 Subject: [PATCH 07/11] CVE-2019-7573, CVE-2019-7576: Fix buffer overreads in
 InitMS_ADPCM If MS ADPCM format chunk was too short, InitMS_ADPCM() parsing
 it could read past the end of chunk data. This patch fixes it.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 CVE-2019-7573
 https://bugzilla.libsdl.org/show_bug.cgi?id=4491
 CVE-2019-7576
 https://bugzilla.libsdl.org/show_bug.cgi?id=4490
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 --HG--
 branch : SDL-1.2
 ---
 src/audio/SDL_wave.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)
 diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c
 index 4159eb710..88ac2cca6 100644
 --- a/src/audio/SDL_wave.c
 +++ b/src/audio/SDL_wave.c
@@ -44,12 +44,13 @@ static struct MS_ADPCM_decoder {
 	struct MS_ADPCM_decodestate state[2];
 } MS_ADPCM_state;
 -static int InitMS_ADPCM(WaveFMT *format)
 +static int InitMS_ADPCM(WaveFMT *format, int length)
 {
 -	Uint8 *rogue_feel;
 +	Uint8 *rogue_feel, *rogue_feel_end;
 	int i;
 	/* Set the rogue pointer to the MS_ADPCM specific data */
 +	if (length < sizeof(*format)) goto too_short;
 	MS_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding);
 	MS_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels);
 	MS_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency);
@@ -58,9 +59,11 @@ static int InitMS_ADPCM(WaveFMT *format)
 	MS_ADPCM_state.wavefmt.bitspersample =
 					 SDL_SwapLE16(format->bitspersample);
 	rogue_feel = (Uint8 *)format+sizeof(*format);
 +	rogue_feel_end = (Uint8 *)format + length;
 	if ( sizeof(*format) == 16 ) {
 		rogue_feel += sizeof(Uint16);
 	}
 +	if (rogue_feel + 4 > rogue_feel_end) goto too_short;
 	MS_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]);
 	rogue_feel += sizeof(Uint16);
 	MS_ADPCM_state.wNumCoef = ((rogue_feel[1]<<8)|rogue_feel[0]);
@@ -70,12 +73,16 @@ static int InitMS_ADPCM(WaveFMT *format)
 		return(-1);
 	}
 	for ( i=0; i<MS_ADPCM_state.wNumCoef; ++i ) {
 +		if (rogue_feel + 4 > rogue_feel_end) goto too_short;
 		MS_ADPCM_state.aCoeff[i][0] = ((rogue_feel[1]<<8)|rogue_feel[0]);
 		rogue_feel += sizeof(Uint16);
 		MS_ADPCM_state.aCoeff[i][1] = ((rogue_feel[1]<<8)|rogue_feel[0]);
 		rogue_feel += sizeof(Uint16);
 	}
 	return(0);
 +too_short:
 +	SDL_SetError("Unexpected length of a chunk with a MS ADPCM format");
 +	return(-1);
 }
 static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state,
@@ -495,7 +502,7 @@ SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
 			break;
 		case MS_ADPCM_CODE:
 			/* Try to understand this */
 -			if ( InitMS_ADPCM(format) < 0 ) {
 +			if ( InitMS_ADPCM(format, lenread) < 0 ) {
 				was_error = 1;
 				goto done;
 			}
 -- 
 2.21.0
--- a/SOURCES/0008-CVE-2019-7575-Fix-a-buffer-overwrite-in-MS_ADPCM_dec.patch
+++ b/SOURCES/0008-CVE-2019-7575-Fix-a-buffer-overwrite-in-MS_ADPCM_dec.patch
@ -0,0 +1,86 @@
 From 730c8b917e7deecc3cdf9ac9eb20e2b7e6450356 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Mon, 10 Jun 2019 09:25:05 -0700
 Subject: [PATCH 08/11] CVE-2019-7575: Fix a buffer overwrite in
 MS_ADPCM_decode If a WAV format defines shorter audio stream and decoded MS
 ADPCM data chunk is longer, decoding continued past the output audio buffer.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This fix is based on a patch from
 <https://bugzilla.libsdl.org/show_bug.cgi?id=4492>.
 https://bugzilla.libsdl.org/show_bug.cgi?id=4493
 CVE-2019-7575
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 --HG--
 branch : SDL-1.2
 ---
 src/audio/SDL_wave.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)
 diff --git a/src/audio/SDL_wave.c b/src/audio/SDL_wave.c
 index 88ac2cca6..5f9365147 100644
 --- a/src/audio/SDL_wave.c
 +++ b/src/audio/SDL_wave.c
@@ -122,7 +122,7 @@ static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state,
 static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 {
 	struct MS_ADPCM_decodestate *state[2];
 -	Uint8 *freeable, *encoded, *encoded_end, *decoded;
 +	Uint8 *freeable, *encoded, *encoded_end, *decoded, *decoded_end;
 	Sint32 encoded_len, samplesleft;
 	Sint8 nybble, stereo;
 	Sint16 *coeff[2];
@@ -142,6 +142,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 		return(-1);
 	}
 	decoded = *audio_buf;
 +	decoded_end = decoded + *audio_len;
 	/* Get ready... Go! */
 	stereo = (MS_ADPCM_state.wavefmt.channels == 2);
@@ -149,7 +150,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	state[1] = &MS_ADPCM_state.state[stereo];
 	while ( encoded_len >= MS_ADPCM_state.wavefmt.blockalign ) {
 		/* Grab the initial information for this block */
 -		if (encoded + 7 + (stereo ? 7 : 0) > encoded_end) goto too_short;
 +		if (encoded + 7 + (stereo ? 7 : 0) > encoded_end) goto invalid_size;
 		state[0]->hPredictor = *encoded++;
 		if ( stereo ) {
 			state[1]->hPredictor = *encoded++;
@@ -179,6 +180,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 		coeff[1] = MS_ADPCM_state.aCoeff[state[1]->hPredictor];
 		/* Store the two initial samples we start with */
 +		if (decoded + 4 + (stereo ? 4 : 0) > decoded_end) goto invalid_size;
 		decoded[0] = state[0]->iSamp2&0xFF;
 		decoded[1] = state[0]->iSamp2>>8;
 		decoded += 2;
@@ -200,7 +202,8 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 		samplesleft = (MS_ADPCM_state.wSamplesPerBlock-2)*
 					MS_ADPCM_state.wavefmt.channels;
 		while ( samplesleft > 0 ) {
 -			if (encoded + 1 > encoded_end) goto too_short;
 +			if (encoded + 1 > encoded_end) goto invalid_size;
 +			if (decoded + 4 > decoded_end) goto invalid_size;
 			nybble = (*encoded)>>4;
 			new_sample = MS_ADPCM_nibble(state[0],nybble,coeff[0]);
@@ -223,8 +226,8 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
 	}
 	SDL_free(freeable);
 	return(0);
 -too_short:
 -	SDL_SetError("Too short chunk for a MS ADPCM decoder");
 +invalid_size:
 +	SDL_SetError("Unexpected chunk length for a MS ADPCM decoder");
 	SDL_free(freeable);
 	return(-1);
 invalid_predictor:
 -- 
 2.21.0
--- a/SOURCES/0009-CVE-2019-7635-Reject-BMP-images-with-pixel-colors-ou.patch
+++ b/SOURCES/0009-CVE-2019-7635-Reject-BMP-images-with-pixel-colors-ou.patch
@ -0,0 +1,68 @@
 From 974b6b063b652317f1a2df12834c829415529bc5 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Tue, 11 Jun 2019 06:28:12 -0700
 Subject: [PATCH 09/11] CVE-2019-7635: Reject BMP images with pixel colors out
 the palette If a 1-, 4-, or 8-bit per pixel BMP image declares less used
 colors than the palette offers an SDL_Surface with a palette of the indicated
 number of used colors is created. If some of the image's pixel refer to a
 color number higher then the maximal used colors, a subsequent bliting
 operation on the surface will look up a color past a blit map (that is based
 on the palette) memory. I.e. passing such SDL_Surface to e.g. an
 SDL_DisplayFormat() function will result in a buffer overread in a blit
 function.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 This patch fixes it by validing each pixel's color to be less than the
 maximal color number in the palette. A validation failure raises an
 error from a SDL_LoadBMP_RW() function.
 CVE-2019-7635
 https://bugzilla.libsdl.org/show_bug.cgi?id=4498
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 --HG--
 branch : SDL-1.2
 ---
 src/video/SDL_bmp.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c
 index d56cfd83a..8acae3bcb 100644
 --- a/src/video/SDL_bmp.c
 +++ b/src/video/SDL_bmp.c
@@ -296,6 +296,12 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops *src, int freesrc)
 				}
 				*(bits+i) = (pixel>>shift);
 				pixel <<= ExpandBMP;
 +				if ( bits[i] >= biClrUsed ) {
 +					SDL_SetError(
 +						"A BMP image contains a pixel with a color out of the palette");
 +					was_error = SDL_TRUE;
 +					goto done;
 +				}
 			} }
 			break;
@@ -306,6 +312,16 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops *src, int freesrc)
 				was_error = SDL_TRUE;
 				goto done;
 			}
 +			if ( 8 == biBitCount && palette && biClrUsed < (1 << biBitCount ) ) {
 +				for ( i=0; i<surface->w; ++i ) {
 +					if ( bits[i] >= biClrUsed ) {
 +						SDL_SetError(
 +							"A BMP image contains a pixel with a color out of the palette");
 +						was_error = SDL_TRUE;
 +						goto done;
 +					}
 +				}
 +			}
 #if SDL_BYTEORDER == SDL_BIG_ENDIAN
 			/* Byte-swap the pixels if needed. Note that the 24bpp
 			   case has already been taken care of above. */
 -- 
 2.21.0
--- a/SOURCES/0010-CVE-2019-7638-CVE-2019-7636-Refuse-loading-BMP-image.patch
+++ b/SOURCES/0010-CVE-2019-7638-CVE-2019-7636-Refuse-loading-BMP-image.patch
@ -0,0 +1,56 @@
 From 73161afdf77e2cf90f47c9be0bc970dadedb5d7c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Fri, 15 Feb 2019 16:52:27 +0100
 Subject: [PATCH 10/11] CVE-2019-7638, CVE-2019-7636: Refuse loading BMP images
 with too high number of colors
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 If a BMP file that defines more colors than can fit into
 a palette of color depth defined in the same BMP file is loaded by
 SDL_LoadBMP_RW() function, invalid number of colors is set into
 resulting SDL surface.
 Then if the SDL surface is passed to SDL_DisplayFormat() function to
 convert the surface format into a native video format, a buffer
 overread will happen in Map1to1() or Map1toN() function
 (CVE-2019-7638). (The choice of the mapping function depends on
 a actual video hardware.)
 In addition SDL_GetRGB() called indirectly from SDL_DisplayFormat()
 performs the same buffer overread (CVE-2019-7636).
 There is also probably a buffer overwrite when the SDL_LoadBMP_RW()
 loads colors from a file.
 This patch fixes it by refusing loading such badly damaged BMP files.
 CVE-2019-7638
 https://bugzilla.libsdl.org/show_bug.cgi?id=4500
 CVE-2019-7636
 https://bugzilla.libsdl.org/show_bug.cgi?id=4499
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 ---
 src/video/SDL_bmp.c | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/src/video/SDL_bmp.c b/src/video/SDL_bmp.c
 index 8acae3bcb..8eadc5f66 100644
 --- a/src/video/SDL_bmp.c
 +++ b/src/video/SDL_bmp.c
@@ -233,6 +233,10 @@ SDL_Surface * SDL_LoadBMP_RW (SDL_RWops *src, int freesrc)
 	if ( palette ) {
 		if ( biClrUsed == 0 ) {
 			biClrUsed = 1 << biBitCount;
 +		} else if ( biClrUsed > (1 << biBitCount) ) {
 +			SDL_SetError("BMP file has an invalid number of colors");
 +			was_error = SDL_TRUE;
 +			goto done;
 		}
 		if ( biSize == 12 ) {
 			for ( i = 0; i < (int)biClrUsed; ++i ) {
 -- 
 2.21.0
--- a/SOURCES/0011-CVE-2019-7637-Fix-in-integer-overflow-in-SDL_Calcula.patch
+++ b/SOURCES/0011-CVE-2019-7637-Fix-in-integer-overflow-in-SDL_Calcula.patch
@ -0,0 +1,210 @@
 From 7cafd3e820489f17f86d0d897ad9719ef54599f1 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
 Date: Mon, 18 Feb 2019 13:53:16 +0100
 Subject: [PATCH 11/11] CVE-2019-7637: Fix in integer overflow in
 SDL_CalculatePitch
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 If a too large width is passed to SDL_SetVideoMode() the width travels
 to SDL_CalculatePitch() where the width (e.g. 65535) is multiplied by
 BytesPerPixel (e.g. 4) and the result is stored into Uint16 pitch
 variable. During this arithmetics an integer overflow can happen (e.g.
 the value is clamped as 65532). As a result SDL_Surface with a pitch
 smaller than width * BytesPerPixel is created, too small pixel buffer
 is allocated and when the SDL_Surface is processed in SDL_FillRect()
 a buffer overflow occurs.
 This can be reproduced with "./graywin -width 21312312313123213213213"
 command.
 This patch fixes is by using a very careful arithmetics in
 SDL_CalculatePitch(). If an overflow is detected, an error is reported
 back as a special 0 value. We assume that 0-width surfaces do not
 occur in the wild. Since SDL_CalculatePitch() is a private function,
 we can change the semantics.
 CVE-2019-7637
 https://bugzilla.libsdl.org/show_bug.cgi?id=4497
 Signed-off-by: Petr Písař <ppisar@redhat.com>
 ---
 src/video/SDL_pixels.c          | 41 +++++++++++++++++++++++++++------
 src/video/gapi/SDL_gapivideo.c  |  3 +++
 src/video/nanox/SDL_nxvideo.c   |  4 ++++
 src/video/ps2gs/SDL_gsvideo.c   |  3 +++
 src/video/ps3/SDL_ps3video.c    |  3 +++
 src/video/windib/SDL_dibvideo.c |  3 +++
 src/video/windx5/SDL_dx5video.c |  3 +++
 src/video/x11/SDL_x11video.c    |  4 ++++
 8 files changed, 57 insertions(+), 7 deletions(-)
 diff --git a/src/video/SDL_pixels.c b/src/video/SDL_pixels.c
 index 1a7fd518f..44626b749 100644
 --- a/src/video/SDL_pixels.c
 +++ b/src/video/SDL_pixels.c
@@ -286,26 +286,53 @@ void SDL_DitherColors(SDL_Color *colors, int bpp)
 	}
 }
 /* 
 - * Calculate the pad-aligned scanline width of a surface
 + * Calculate the pad-aligned scanline width of a surface. Return 0 in case of
 + * an error.
  */
 Uint16 SDL_CalculatePitch(SDL_Surface *surface)
 {
 -	Uint16 pitch;
 +	unsigned int pitch = 0;
 	/* Surface should be 4-byte aligned for speed */
 -	pitch = surface->w*surface->format->BytesPerPixel;
 +	/* The code tries to prevent from an Uint16 overflow. */;
 +	for (Uint8 byte = surface->format->BytesPerPixel; byte; byte--) {
 +		pitch += (unsigned int)surface->w;
 +		if (pitch < surface->w) {
 +			SDL_SetError("A scanline is too wide");
 +			return(0);
 +		}
 +	}
 	switch (surface->format->BitsPerPixel) {
 		case 1:
 -			pitch = (pitch+7)/8;
 +			if (pitch % 8) {
 +				pitch = pitch / 8 + 1;
 +			} else {
 +				pitch = pitch / 8;
 +			}
 			break;
 		case 4:
 -			pitch = (pitch+1)/2;
 +			if (pitch % 2) {
 +				pitch = pitch / 2 + 1;
 +			} else {
 +				pitch = pitch / 2;
 +			}
 			break;
 		default:
 			break;
 	}
 -	pitch = (pitch + 3) & ~3;	/* 4-byte aligning */
 -	return(pitch);
 +	/* 4-byte aligning */
 +	if (pitch & 3) {
 +		if (pitch + 3 < pitch) {
 +			SDL_SetError("A scanline is too wide");
 +			return(0);
 +		}
 +		pitch = (pitch + 3) & ~3;
 +	}
 +	if (pitch > 0xFFFF) {
 +		SDL_SetError("A scanline is too wide");
 +		return(0);
 +	}
 +	return((Uint16)pitch);
 }
 /*
  * Match an RGB value to a particular palette index
 diff --git a/src/video/gapi/SDL_gapivideo.c b/src/video/gapi/SDL_gapivideo.c
 index 86deadc75..8a0648536 100644
 --- a/src/video/gapi/SDL_gapivideo.c
 +++ b/src/video/gapi/SDL_gapivideo.c
@@ -733,6 +733,9 @@ SDL_Surface *GAPI_SetVideoMode(_THIS, SDL_Surface *current,
 	video->w = gapi->w = width;
 	video->h = gapi->h = height;
 	video->pitch = SDL_CalculatePitch(video); 
 +	if (!current->pitch) {
 +		return(NULL);
 +	}
 	/* Small fix for WinCE/Win32 - when activating window
 	   SDL_VideoSurface is equal to zero, so activating code
 diff --git a/src/video/nanox/SDL_nxvideo.c b/src/video/nanox/SDL_nxvideo.c
 index b188e0958..cbdd09a08 100644
 --- a/src/video/nanox/SDL_nxvideo.c
 +++ b/src/video/nanox/SDL_nxvideo.c
@@ -378,6 +378,10 @@ SDL_Surface * NX_SetVideoMode (_THIS, SDL_Surface * current,
         current -> w = width ;
         current -> h = height ;
         current -> pitch = SDL_CalculatePitch (current) ;
 +        if (!current->pitch) {
 +            current = NULL;
 +            goto done;
 +        }
         NX_ResizeImage (this, current, flags) ;
     }
 diff --git a/src/video/ps2gs/SDL_gsvideo.c b/src/video/ps2gs/SDL_gsvideo.c
 index e172c60dc..329086680 100644
 --- a/src/video/ps2gs/SDL_gsvideo.c
 +++ b/src/video/ps2gs/SDL_gsvideo.c
@@ -479,6 +479,9 @@ static SDL_Surface *GS_SetVideoMode(_THIS, SDL_Surface *current,
 	current->w = width;
 	current->h = height;
 	current->pitch = SDL_CalculatePitch(current);
 +	if (!current->pitch) {
 +		return(NULL);
 +	}
 	/* Memory map the DMA area for block memory transfer */
 	if ( ! mapped_mem ) {
 diff --git a/src/video/ps3/SDL_ps3video.c b/src/video/ps3/SDL_ps3video.c
 index d5519e051..17848e33a 100644
 --- a/src/video/ps3/SDL_ps3video.c
 +++ b/src/video/ps3/SDL_ps3video.c
@@ -339,6 +339,9 @@ static SDL_Surface *PS3_SetVideoMode(_THIS, SDL_Surface * current, int width, in
 	current->w = width;
 	current->h = height;
 	current->pitch = SDL_CalculatePitch(current);
 +	if (!current->pitch) {
 +		return(NULL);
 +	}
 	/* Alloc aligned mem for current->pixels */
 	s_pixels = memalign(16, current->h * current->pitch);
 diff --git a/src/video/windib/SDL_dibvideo.c b/src/video/windib/SDL_dibvideo.c
 index 6187bfcf7..86ebb12a3 100644
 --- a/src/video/windib/SDL_dibvideo.c
 +++ b/src/video/windib/SDL_dibvideo.c
@@ -675,6 +675,9 @@ SDL_Surface *DIB_SetVideoMode(_THIS, SDL_Surface *current,
 	video->w = width;
 	video->h = height;
 	video->pitch = SDL_CalculatePitch(video);
 +	if (!current->pitch) {
 +		return(NULL);
 +	}
 	/* Small fix for WinCE/Win32 - when activating window
 	   SDL_VideoSurface is equal to zero, so activating code
 diff --git a/src/video/windx5/SDL_dx5video.c b/src/video/windx5/SDL_dx5video.c
 index f80ca97b0..39fc4fc37 100644
 --- a/src/video/windx5/SDL_dx5video.c
 +++ b/src/video/windx5/SDL_dx5video.c
@@ -1127,6 +1127,9 @@ SDL_Surface *DX5_SetVideoMode(_THIS, SDL_Surface *current,
 		video->w = width;
 		video->h = height;
 		video->pitch = SDL_CalculatePitch(video);
 +		if (!current->pitch) {
 +			return(NULL);
 +		}
 #ifndef NO_CHANGEDISPLAYSETTINGS
 		/* Set fullscreen mode if appropriate.
 diff --git a/src/video/x11/SDL_x11video.c b/src/video/x11/SDL_x11video.c
 index 79e60f971..45d1f79be 100644
 --- a/src/video/x11/SDL_x11video.c
 +++ b/src/video/x11/SDL_x11video.c
@@ -1220,6 +1220,10 @@ SDL_Surface *X11_SetVideoMode(_THIS, SDL_Surface *current,
 		current->w = width;
 		current->h = height;
 		current->pitch = SDL_CalculatePitch(current);
 +		if (!current->pitch) {
 +			current = NULL;
 +			goto done;
 +		}
 		if (X11_ResizeImage(this, current, flags) < 0) {
 			current = NULL;
 			goto done;
 -- 
 2.21.0
--- a/SOURCES/SDL-1.2.10-GrabNotViewable.patch
+++ b/SOURCES/SDL-1.2.10-GrabNotViewable.patch
@ -0,0 +1,22 @@
 Makes SDL-1.2 SDL_WM_GrabInput() non-blocking in case of SDL window is not
 viewable. Patch provided by <pbonzini@redhat.com>.
 See <http://bugzilla.libsdl.org/show_bug.cgi?id=1155>.
 --- ./src/video/x11/SDL_x11wm.c	2007-12-31 04:48:13.000000000 +0000
 +++ ./src/video/x11/SDL_x11wm.c	2009-01-15 10:27:14.000000000 +0000
@@ -351,13 +351,14 @@ SDL_GrabMode X11_GrabInputNoLock(_THIS, 
 			result = XGrabPointer(SDL_Display, SDL_Window, True, 0,
 						GrabModeAsync, GrabModeAsync,
 						SDL_Window, None, CurrentTime);
 -			if ( result == GrabSuccess ) {
 +			if ( result == GrabSuccess || result == GrabNotViewable ) {
 				break;
 			}
 			SDL_Delay(100);
 		}
 		if ( result != GrabSuccess ) {
 			/* Uh, oh, what do we do here? */ ;
 +			return(SDL_GRAB_OFF);
 		}
 		/* Now grab the keyboard */
 		XGrabKeyboard(SDL_Display, WMwindow, True,
--- a/SOURCES/SDL-1.2.12-multilib.patch
+++ b/SOURCES/SDL-1.2.12-multilib.patch
@ -0,0 +1,25 @@
 diff -up SDL-1.2.12/sdl-config.in.multilib SDL-1.2.12/sdl-config.in
 --- SDL-1.2.12/sdl-config.in.multilib	2007-07-20 07:52:45.000000000 +0200
 +++ SDL-1.2.12/sdl-config.in	2007-11-06 17:07:25.000000000 +0100
@@ -3,7 +3,6 @@
 prefix=@prefix@
 exec_prefix=@exec_prefix@
 exec_prefix_set=no
 -libdir=@libdir@
 @ENABLE_STATIC_FALSE@usage="\
 @ENABLE_STATIC_FALSE@Usage: sdl-config [--prefix[=DIR]] [--exec-prefix[=DIR]] [--version] [--cflags] [--libs]"
@@ -45,11 +44,11 @@ while test $# -gt 0; do
       echo -I@includedir@/SDL @SDL_CFLAGS@
       ;;
 @ENABLE_SHARED_TRUE@    --libs)
 -@ENABLE_SHARED_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_LIBS@
 +@ENABLE_SHARED_TRUE@      echo @SDL_RLD_FLAGS@ @SDL_LIBS@
 @ENABLE_SHARED_TRUE@      ;;
 @ENABLE_STATIC_TRUE@@ENABLE_SHARED_TRUE@    --static-libs)
 @ENABLE_STATIC_TRUE@@ENABLE_SHARED_FALSE@    --libs|--static-libs)
 -@ENABLE_STATIC_TRUE@      echo -L@libdir@ @SDL_RLD_FLAGS@ @SDL_STATIC_LIBS@
 +@ENABLE_STATIC_TRUE@      echo @SDL_RLD_FLAGS@ @SDL_STATIC_LIBS@
 @ENABLE_STATIC_TRUE@      ;;
     *)
       echo "${usage}" 1>&2
--- a/SOURCES/SDL-1.2.15-CVE-2019-13616-validate_image_size_when_loading_BMP_files.patch
+++ b/SOURCES/SDL-1.2.15-CVE-2019-13616-validate_image_size_when_loading_BMP_files.patch
@ -0,0 +1,23 @@
 changeset:   12960:ad1bbfbca760
 branch:      SDL-1.2
 parent:      12914:87d60cae0273
 user:        Ozkan Sezer <sezeroz@gmail.com>
 date:        Tue Jul 30 21:30:24 2019 +0300
 summary:     Fixed bug 4538 - validate image size when loading BMP files
 diff -r 87d60cae0273 -r ad1bbfbca760 src/video/SDL_bmp.c
 --- a/src/video/SDL_bmp.c	Tue Jun 18 23:31:40 2019 +0100
 +++ b/src/video/SDL_bmp.c	Tue Jul 30 21:30:24 2019 +0300
@@ -143,6 +143,11 @@
 	(void) biYPelsPerMeter;
 	(void) biClrImportant;
 +	if (biWidth <= 0 || biHeight == 0) {
 +		SDL_SetError("BMP file with bad dimensions (%dx%d)", biWidth, biHeight);
 +		was_error = SDL_TRUE;
 +		goto done;
 +	}
 	if (biHeight < 0) {
 		topDown = SDL_TRUE;
 		biHeight = -biHeight;
--- a/SOURCES/SDL-1.2.15-SDL_EnableUNICODE_drops_keyboard_events.patch
+++ b/SOURCES/SDL-1.2.15-SDL_EnableUNICODE_drops_keyboard_events.patch
@ -0,0 +1,73 @@
 # HG changeset patch
 # User Sam Lantinga <slouken@libsdl.org>
 # Date 1397799374 25200
 #      Thu Apr 17 22:36:14 2014 -0700
 # Branch SDL-1.2
 # Node ID 0aade9c0203f717fe4b823a176c3c040f1a709f8
 # Parent  22a7f096bb9d4d596f35a93e33608825693462b0
 Fixed bug 2325 - SDL_EnableUNICODE sometimes drops keyboard events completely
 Rafał Mużyło
 The most annoying part of this bug is that though I've found it in two separate apps, I don't have a trivial testcase for it.
 The problem seems to be a condition race, as it's triggered quite randomly (therefore it will be hard to tell whether it really gets fixed, if a probable fix is found).
 While it's specific to SDL 1.2, it seems quite similar to the problem described and fixed in http://forums.libsdl.org/viewtopic.php?p=40503.
 Now, I should start describing the problem.
 A game uses Escape to open menu (the exact key might not be important). Upon opening, it calls SDL_EnableUNICODE(1). Upon closing it calls SDL_EnableUNICODE(0).
 I have an IME running.
 Game uses SDL_PollEvent to get the events.
 If Escape is pressed repeatedly, menu is opened and closed, till it eventually freezes in open state.
 "freezes" in this context means "app itself still runs, but no keyboard events are getting delivered (though - for example - mouse events still are)". "getting delivered" should mean "SDL_PollEvent is not receiving any".
 If it matters, the last delivered keyboard event is a keypress, the release never arrives.
 It seems (no guarantees, due to random nature of the freeze) that unsetting XMODIFIERS (which - AFAIU - will disable IME as far as SDL is concerned) prevents the freeze, therefore the reference to that SDL2 thread.
 diff -r 22a7f096bb9d -r 0aade9c0203f src/video/x11/SDL_x11events.c
 --- a/src/video/x11/SDL_x11events.c	Sun Dec 01 00:00:17 2013 -0500
 +++ b/src/video/x11/SDL_x11events.c	Thu Apr 17 22:36:14 2014 -0700
@@ -395,6 +395,8 @@
 {
 	int posted;
 	XEvent xevent;
 +	int orig_event_type;
 +	KeyCode orig_keycode;
 	SDL_memset(&xevent, '\0', sizeof (XEvent));  /* valgrind fix. --ryan. */
 	XNextEvent(SDL_Display, &xevent);
@@ -410,9 +412,29 @@
 #ifdef X_HAVE_UTF8_STRING
 	/* If we are translating with IM, we need to pass all events
 	   to XFilterEvent, and discard those filtered events immediately.  */
 +	orig_event_type = xevent.type;
 +	if (orig_event_type == KeyPress || orig_event_type == KeyRelease) {
 +	     orig_keycode = xevent.xkey.keycode;
 +	} else {
 +	     orig_keycode = 0;
 +	}
 	if ( SDL_TranslateUNICODE
 	     && SDL_IM != NULL
 	     && XFilterEvent(&xevent, None) ) {
 +	        if (orig_keycode) {
 +	            SDL_keysym keysym;
 +	            static XComposeStatus state;
 +	            char keybuf[32];
 +
 +	            keysym.scancode = xevent.xkey.keycode;
 +	            keysym.sym = X11_TranslateKeycode(SDL_Display, xevent.xkey.keycode);
 +	            keysym.mod = KMOD_NONE;
 +	            keysym.unicode = 0;
 +	            if (orig_event_type == KeyPress && XLookupString(&xevent.xkey, keybuf, sizeof(keybuf), NULL, &state))
 +	                keysym.unicode = (Uint8)keybuf[0];
 +
 +	            SDL_PrivateKeyboard(orig_event_type == KeyPress ? SDL_PRESSED : SDL_RELEASED, &keysym);
 +	        }
 		return 0;
 	}
 #endif
--- a/SOURCES/SDL-1.2.15-add_sdl_config_man.patch
+++ b/SOURCES/SDL-1.2.15-add_sdl_config_man.patch
@ -0,0 +1,90 @@
 diff -r 91ad7b43317a Makefile.in
 --- a/Makefile.in	Sun Jun 02 20:48:53 2013 +0600
 +++ b/Makefile.in	Wed Jun 19 10:34:27 2013 +0200
@@ -98,6 +98,11 @@
 	$(SHELL) $(auxdir)/mkinstalldirs $(DESTDIR)$(libdir)/pkgconfig
 	$(INSTALL) -m 644 sdl.pc $(DESTDIR)$(libdir)/pkgconfig
 install-man:
 +	$(SHELL) $(auxdir)/mkinstalldirs $(DESTDIR)$(mandir)/man1
 +	for src in $(srcdir)/docs/man1/*.1; do \
 +	    file=`echo $$src | sed -e 's|^.*/||'`; \
 +	    $(INSTALL) -m 644 $$src $(DESTDIR)$(mandir)/man1/$$file; \
 +	done
 	$(SHELL) $(auxdir)/mkinstalldirs $(DESTDIR)$(mandir)/man3
 	for src in $(srcdir)/docs/man3/*.3; do \
 	    file=`echo $$src | sed -e 's|^.*/||'`; \
@@ -120,6 +125,10 @@
 	rm -f $(DESTDIR)$(datadir)/aclocal/sdl.m4
 	rm -f $(DESTDIR)$(libdir)/pkgconfig/sdl.pc
 uninstall-man:
 +	for src in $(srcdir)/docs/man1/*.1; do \
 +	    file=`echo $$src | sed -e 's|^.*/||'`; \
 +	    rm -f $(DESTDIR)$(mandir)/man1/$$file; \
 +	done
 	for src in $(srcdir)/docs/man3/*.3; do \
 	    file=`echo $$src | sed -e 's|^.*/||'`; \
 	    rm -f $(DESTDIR)$(mandir)/man3/$$file; \
 diff -r 91ad7b43317a docs/man1/sdl-config.1
 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
 +++ b/docs/man1/sdl-config.1	Wed Jun 19 10:34:27 2013 +0200
@@ -0,0 +1,60 @@
 +.TH sdl-config 1 "2013-06-19" "SDL 1.2"
 +.SH NAME
 +sdl-config \- script to get information about the installed version of SDL
 +.SH SYNOPSIS
 +\fBsdl-config
 +[\~--prefix[=\fIDIR\fP]\~]
 +[\~--exec-prefix[=\fIDIR\fP]\~]
 +[\~--version\~] [\~--cflags\~] [\~--libs\~] [\~--static-libs\~]\fR
 +.SH DESCRIPTION
 +.B sdl-config
 +is a tool that is used to configure and determine the compiler and linker
 +flags that should be used to compile and link programs, and libraries, and
 +plugins that use SDL.  It is also used internally by the m4 macros that are
 +included with SDL.
 +.SH OPTIONS
 +.TP
 +.B --cflags
 +Print the compiler flags that are necessary to compile a program or library
 +that uses SDL.
 +.TP
 +.BI --exec-prefix= DIR
 +If specified, use
 +.I DIR
 +instead of the installation exec prefix that SDL was build with when computing
 +the output for the --exec-prefix option. This option must be specified before
 +any of the --cflags, and --libs options.
 +.TP
 +.B --libs
 +Print the linker flags that are necessary to link a program that uses SDL.
 +.TP
 +.BI --prefix= DIR
 +If specified, use DIR instead of the installation prefix that SDL was built
 +with when computing the output for the --prefix, and --exec-prefix options.
 +This option is also used for the exec prefix if --exec-prefix was not
 +specified. This option must be specified before any of the --cflags, and
 +--libs options.
 +.TP
 +.B --static-libs
 +Print the linker flags that are necessary to statically link a program that uses SDL.
 +.TP
 +.B --version
 +Prints the currently installed version of SDL on standard output.
 +.SH EXAMPLES
 +.TP
 +gcc -o main.o $(sdl-config --cflags) main.c
 +is how you might use
 +.B sdl-config
 +to compile a C source file for an executable program.
 +.TP
 +gcc -o my_app $(sdl-config --libs) main.o util.o
 +is how you might use
 +.B sdl-config
 +to link compiled objects into an executable program.
 +.SH AUTHOR
 +The Simple DirectMedia Layer (SDL) library was written by Sam Lantinga.
 +.PP
 +This manual page was written by Branden Robinson, originally for Progeny
 +Linux Systems, Inc., and the Debian Project.
 +.PP
 +This manual page was modified by Petr Pisar to match original SDL distribution.
--- a/SOURCES/SDL-1.2.15-const_XData32.patch
+++ b/SOURCES/SDL-1.2.15-const_XData32.patch
@ -0,0 +1,16 @@
 libX11-1.5.99.901 has changed prototype of _XData32
 <http://bugzilla.libsdl.org/show_bug.cgi?id=1769>
 diff -r b6b2829cd7ef src/video/x11/SDL_x11sym.h
 --- a/src/video/x11/SDL_x11sym.h	Wed Feb 27 15:20:31 2013 -0800
 +++ b/src/video/x11/SDL_x11sym.h	Wed Mar 27 16:07:23 2013 +0100
@@ -165,7 +165,7 @@
  */
 #ifdef LONG64
 SDL_X11_MODULE(IO_32BIT)
 -SDL_X11_SYM(int,_XData32,(Display *dpy,register long *data,unsigned len),(dpy,data,len),return)
 +SDL_X11_SYM(int,_XData32,(Display *dpy,register _Xconst long *data,unsigned len),(dpy,data,len),return)
 SDL_X11_SYM(void,_XRead32,(Display *dpy,register long *data,long len),(dpy,data,len),)
 #endif
--- a/SOURCES/SDL-1.2.15-ignore_insane_joystick_axis.patch
+++ b/SOURCES/SDL-1.2.15-ignore_insane_joystick_axis.patch
@ -0,0 +1,20 @@
 changeset:   6324:95abff7adcc2
 branch:      SDL-1.2
 parent:      6306:2b923729fd01
 user:        Ryan C. Gordon <icculus@icculus.org>
 date:        Sun Jun 03 04:49:25 2012 -0400
 summary:     Linux evdev: ignore joystick axis events if they aren't in a sane range.
 diff -r 2b923729fd01 -r 95abff7adcc2 src/joystick/linux/SDL_sysjoystick.c
 --- a/src/joystick/linux/SDL_sysjoystick.c	Sat May 12 23:32:51 2012 -0700
 +++ b/src/joystick/linux/SDL_sysjoystick.c	Sun Jun 03 04:49:25 2012 -0400
@@ -1106,6 +1106,9 @@
 				}
 				break;
 			    case EV_ABS:
 +				if (code > ABS_MISC) {
 +					break;
 +				}
 				switch (code) {
 				    case ABS_HAT0X:
 				    case ABS_HAT0Y:
--- a/SOURCES/SDL-1.2.15-no-default-backing-store.patch
+++ b/SOURCES/SDL-1.2.15-no-default-backing-store.patch
@ -0,0 +1,24 @@
 Do not harness backing store by default
 xorg-server 1.15 enables backing store if composite extension is enabled
 (default settings). Harnessing backing store through compositor leads to
 tearing effect.
 This patch reverts default harnessing backing store to conditional use if
 SDL_VIDEO_X11_BACKINGSTORE environment variable exists.
 <https://bugzilla.libsdl.org/show_bug.cgi?id=2383>
 <https://bugzilla.redhat.com/show_bug.cgi?id=1073057>
 diff -up SDL-1.2.15/src/video/x11/SDL_x11video.c.jx SDL-1.2.15/src/video/x11/SDL_x11video.c
 --- SDL-1.2.15/src/video/x11/SDL_x11video.c.jx	2012-01-19 01:30:06.000000000 -0500
 +++ SDL-1.2.15/src/video/x11/SDL_x11video.c	2014-03-04 14:39:34.691545549 -0500
@@ -1088,7 +1088,7 @@ static int X11_CreateWindow(_THIS, SDL_S
 		}
 	}
 -#if 0 /* This is an experiment - are the graphics faster now? - nope. */
 +#if 1 /* This is an experiment - are the graphics faster now? - nope. */
 	if ( SDL_getenv("SDL_VIDEO_X11_BACKINGSTORE") )
 #endif
 	/* Cache the window in the server, when possible */
--- a/SOURCES/SDL-1.2.15-vec_perm-ppc64le.patch
+++ b/SOURCES/SDL-1.2.15-vec_perm-ppc64le.patch
@ -0,0 +1,87 @@
 Correct vec_perm() application on little-endian 64-bit PowerPC
 The LE transformation for vec_perm has an implicit assumption that the
 permutation is being used to reorder vector elements (in this case 4-byte
 integer word elements), not to reorder bytes within those elements.  Although
 this is legal behavior, it is not anticipated by the transformation performed
 by the compilers.
 This causes pygame-1.9.1 test failure on PPC64LE because blitted pixmaps are
 corrupted there due to how SDL uses vec_perm().
 <https://bugzilla.redhat.com/show_bug.cgi?id=1392465>
 --- SDL-1.2.15/src/video/SDL_blit_N.c.ori	2017-09-04 05:56:17.759347525 -0400
 +++ SDL-1.2.15/src/video/SDL_blit_N.c	2017-09-06 05:36:20.570789610 -0400
@@ -146,6 +146,32 @@ static vector unsigned char calc_swizzle
     return(vswiz);
 }
 +/* reorder bytes for PowerPC little endian */
 +static vector unsigned char reorder_ppc64le_vec(vector unsigned char vpermute)
 +{
 +    /* The result vector of calc_swizzle32 reorder bytes using vec_perm.
 +       The LE transformation for vec_perm has an implicit assumption
 +       that the permutation is being used to reorder vector elements,
 +       not to reorder bytes within those elements.  
 +       Unfortunatly the result order is not the expected one for powerpc
 +       little endian when the two first vector parameters of vec_perm are
 +       not of type 'vector char'. This is because the numbering from the
 +       left for BE, and numbering from the right for LE, produces a
 +       different interpretation of what the odd and even lanes are.
 +       Refer to fedora bug 1392465
 +     */
 +
 +    const vector unsigned char ppc64le_reorder = VECUINT8_LITERAL(
 +                                      0x01, 0x00, 0x03, 0x02,
 +                                      0x05, 0x04, 0x07, 0x06,
 +                                      0x09, 0x08, 0x0B, 0x0A,
 +                                      0x0D, 0x0C, 0x0F, 0x0E );
 +
 +    vector unsigned char vswiz_ppc64le;
 +    vswiz_ppc64le = vec_perm(vpermute, vpermute, ppc64le_reorder);
 +    return(vswiz_ppc64le);
 +}
 +
 static void Blit_RGB888_RGB565(SDL_BlitInfo *info);
 static void Blit_RGB888_RGB565Altivec(SDL_BlitInfo *info) {
     int height = info->d_height;
@@ -631,6 +657,12 @@ static void Blit32to32KeyAltivec(SDL_Bli
                 vsel = (vector unsigned char)vec_and(vs, vrgbmask);
                 vsel = (vector unsigned char)vec_cmpeq(vs, vckey);
                 /* permute the src vec to the dest format */
 +
 +#if defined(__powerpc__) && (SDL_BYTEORDER == SDL_LIL_ENDIAN)
 +            /* reorder bytes for PowerPC little endian */
 +            vpermute = reorder_ppc64le_vec(vpermute);
 +#endif
 +
                 vs = vec_perm(vs, valpha, vpermute);
                 /* load the destination vec */
                 vd = vec_ld(0, dstp);
@@ -704,6 +736,12 @@ static void ConvertAltivec32to32_noprefe
             src += 4;
             width -= 4;
             vbits = vec_perm(vbits, voverflow, valigner);  /* src is ready. */
 +
 +#if defined(__powerpc__) && (SDL_BYTEORDER == SDL_LIL_ENDIAN)
 +            /* reorder bytes for PowerPC little endian */
 +            vpermute = reorder_ppc64le_vec(vpermute);
 +#endif
 +
             vbits = vec_perm(vbits, vzero, vpermute);  /* swizzle it. */
             vec_st(vbits, 0, dst);  /* store it back out. */
             dst += 4;
@@ -786,6 +824,12 @@ static void ConvertAltivec32to32_prefetc
             src += 4;
             width -= 4;
             vbits = vec_perm(vbits, voverflow, valigner);  /* src is ready. */
 +
 +#if defined(__powerpc__) && (SDL_BYTEORDER == SDL_LIL_ENDIAN) 
 +            /* reorder bytes for PowerPC little endian */
 +            vpermute = reorder_ppc64le_vec(vpermute);
 +#endif
 +
             vbits = vec_perm(vbits, vzero, vpermute);  /* swizzle it. */
             vec_st(vbits, 0, dst);  /* store it back out. */
             dst += 4;
--- a/SOURCES/SDL_config.h
+++ b/SOURCES/SDL_config.h
@ -0,0 +1,78 @@
 /*
    SDL - Simple DirectMedia Layer
    Copyright (C) 1997-2006 Sam Lantinga
    This library is free software; you can redistribute it and/or
    modify it under the terms of the GNU Lesser General Public
    License as published by the Free Software Foundation; either
    version 2.1 of the License, or (at your option) any later version.
    This library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
    Lesser General Public License for more details.
    You should have received a copy of the GNU Lesser General Public
    License along with this library; if not, write to the Free Software
    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
    Sam Lantinga
    slouken@libsdl.org
 */
 /*
 * This SDL_config.h is a wrapper include file for the original SDL_config.h, 
 * which has been renamed to SDL_config-<arch>.h. There are conflicts for the 
 * original SDL_config.h on multilib systems, which result from arch-specific
 * configuration options. Please do not use the arch-specific file directly.
 *
 * Copyright (C) 2006 Red Hat, Inc.
 * Thomas Woerner <twoerner@redhat.com>
 */
 #ifdef SDL_config_wrapper_h
 #error "SDL_config_wrapper_h should not be defined!"
 #endif
 #define SDL_config_wrapper_h
 #if defined(__i386__)
 #include "SDL_config-i386.h"
 #elif defined(__ia64__)
 #include "SDL_config-ia64.h"
 #elif defined(__powerpc64__)
 #if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
 #include "SDL_config-ppc64.h"
 #else
 #include "SDL_config-ppc64le.h"
 #endif
 #elif defined(__powerpc__)
 #include "SDL_config-ppc.h"
 #elif defined(__s390x__)
 #include "SDL_config-s390x.h"
 #elif defined(__s390__)
 #include "SDL_config-s390.h"
 #elif defined(__x86_64__)
 #include "SDL_config-x86_64.h"
 #elif defined(__arm__)
 #include "SDL_config-arm.h"
 #elif defined(__alpha__)
 #include "SDL_config-alpha.h"
 #elif defined(__sparc__) && defined (__arch64__)
 #include "SDL_config-sparc64.h"
 #elif defined(__sparc__)
 #include "SDL_config-sparc.h"
 #elif defined(__aarch64__)
 #include "SDL_config-aarch64.h"
 #elif defined(__mips64) && defined(__MIPSEL__)
 #include "SDL_config-mips64el.h"
 #elif defined(__mips64)
 #include "SDL_config-mips64.h"
 #elif defined(__mips) && defined(__MIPSEL__)
 #include "SDL_config-mipsel.h"
 #elif defined(__mips)
 #include "SDL_config-mips.h"
 #else
 #error "The SDL-devel package is not usable with the architecture."
 #endif
 #undef SDL_config_wrapper_h
--- a/SOURCES/repackage.sh
+++ b/SOURCES/repackage.sh
@ -0,0 +1,59 @@
 #!/bin/bash
 #
 # Copyright (C) 2010 Red Hat, Inc.
 # Authors:
 # Thomas Woerner <twoerner@redhat.com>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation; either version 2 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 version=$1
 [ -z "$version" ] && { echo "Usage: $0 <version>"; exit 1; }
 # files to be removed without the main SDL-<version>/ prefix
 declare -a REMOVE
 REMOVE[${#REMOVE[*]}]="symbian.zip"
 # no changes below this line should be needed
 orig="SDL-${version}"
 orig_tgz="${orig}.tar.gz"
 repackaged="${orig}_repackaged"
 repackaged_tar="${repackaged}.tar"
 repackaged_tgz="${repackaged_tar}.gz"
 # pre checks
 [ ! -f "${orig_tgz}" ] && { echo "ERROR: ${orig_tgz} does not exist"; exit 1; }
 [ -f "${repackaged_tgz}" ] && { echo "ERROR: ${repackaged_tgz} already exist"; exit 1; }
 # repackage
 failure=0
 gzip -dc "${orig_tgz}" > "${repackaged_tar}"
 for file in "${REMOVE[@]}"; do
    tar -f "${repackaged_tar}" --delete "${orig}/${file}" >> repackage.log
    [ $? != 0 ] && { echo "ERROR: Could not remove file ${orig}/${file} from archive."; failure=1; } || echo "Removed ${orig}/${file} from archive."
 done
 [ $failure != 0 ] && { echo "See repackage.log for details."; exit 1; }
 gzip -9 -n "${repackaged_tar}"
 # post checks
 RET=0
 for file in "${REMOVE[@]}"; do
    found=$(tar -ztvf "${repackaged_tgz}" | grep "${file}")
    [ -n "$found" ] && { echo "ERROR: file ${file} is still in the repackaged archive."; RET=1; }
 done
 [ $RET == 0 ] && echo "Sucessfully repackaged ${orig}: ${repackaged_tgz}"
 exit $RET
--- a/SPECS/SDL.spec
+++ b/SPECS/SDL.spec
@ -0,0 +1,829 @@
 %if 0%{?rhel}
 %bcond_with arts
 %bcond_with esound
 %bcond_with nas
 %else
 %bcond_without arts
 %bcond_without esound
 %bcond_without nas
 %endif
 Name:       SDL
 Version:    1.2.15
 Release:    39%{?dist}
 Summary:    A cross-platform multimedia library
 URL:        http://www.libsdl.org/
 # The license of the file src/video/fbcon/riva_mmio.h is bad, but the contents
 # of the file has been relicensed to MIT in 2008 by Nvidia for the 
 # xf86_video-nv driver, therefore it can be considered ok.
 # The license in the file src/stdlib/SDL_qsort.c is bad, but author relicensed
 # it to zlib on 2016-02-21,
 # <https://www.mccaughan.org.uk/software/qsort.c-1.14>, bug #1381888.
 License:    LGPLv2+
 # Source: http://www.libsdl.org/release/%%{name}-%%{version}.tar.gz
 # To create the repackaged archive use ./repackage.sh %%{version}
 Source0:    %{name}-%{version}_repackaged.tar.gz
 Source1:    SDL_config.h
 Source2:    repackage.sh
 Patch0:     SDL-1.2.12-multilib.patch
 # Rejected by upstream as sdl1155, rh480065
 Patch1:     SDL-1.2.10-GrabNotViewable.patch
 # Proposded to upstream as sdl1769
 Patch2:     SDL-1.2.15-const_XData32.patch
 # sdl-config(1) manual from Debian, rh948864
 Patch3:     SDL-1.2.15-add_sdl_config_man.patch
 # Upstream fix for sdl1486, rh990677
 Patch4:     SDL-1.2.15-ignore_insane_joystick_axis.patch
 # Do not use backing store by default, sdl2383, rh1073057, rejected by
 # upstream
 Patch5:     SDL-1.2.15-no-default-backing-store.patch
 # Fix processing keyboard events if SDL_EnableUNICODE() is enabled, sdl2325,
 # rh1126136, in upstream after 1.2.15
 Patch6:     SDL-1.2.15-SDL_EnableUNICODE_drops_keyboard_events.patch
 # Fix vec_perm() usage on little-endian 64-bit PowerPC, bug #1392465
 Patch7:     SDL-1.2.15-vec_perm-ppc64le.patch
 #fixed upstream
 Patch8:	    0001-Fixed-bug-4108-Missing-break-statements-in-SDL_CDRes.patch
 #fixes for small errors
 Patch9:	    0001-fix-small-errors-detected-by-coverity.patch
 # upstream bug #4538, in upstream after 1.2.15
 Patch10:    SDL-1.2.15-CVE-2019-13616-validate_image_size_when_loading_BMP_files.patch
 Patch11:	0001-CVE-2019-7572-Fix-a-buffer-overread-in-IMA_ADPCM_nib.patch
 Patch12:	0002-CVE-2019-7578-Fix-a-buffer-overread-in-InitIMA_ADPCM.patch
 Patch13:	0003-CVE-2019-7574-Fix-a-buffer-overread-in-IMA_ADPCM_dec.patch
 Patch14:	0004-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_deco.patch
 Patch15:	0005-CVE-2019-7577-Fix-a-buffer-overread-in-MS_ADPCM_nibb.patch
 Patch16:	0006-CVE-2019-7572-Fix-a-buffer-overwrite-in-IMA_ADPCM_de.patch
 Patch17:	0007-CVE-2019-7573-CVE-2019-7576-Fix-buffer-overreads-in-.patch
 Patch18:	0008-CVE-2019-7575-Fix-a-buffer-overwrite-in-MS_ADPCM_dec.patch
 Patch19:	0009-CVE-2019-7635-Reject-BMP-images-with-pixel-colors-ou.patch
 Patch20:	0010-CVE-2019-7638-CVE-2019-7636-Refuse-loading-BMP-image.patch
 Patch21:	0011-CVE-2019-7637-Fix-in-integer-overflow-in-SDL_Calcula.patch
 BuildRequires:  alsa-lib-devel
 %if %{with arts}
 BuildRequires:  arts-devel
 %endif
 BuildRequires:  coreutils
 %if %{with esound}
 BuildRequires:  esound-devel
 %endif
 BuildRequires:  gcc
 BuildRequires:  glibc-common
 BuildRequires:  mesa-libGL-devel
 BuildRequires:  mesa-libGLU-devel
 BuildRequires:  libXext-devel
 BuildRequires:  libX11-devel
 BuildRequires:  libXrandr-devel
 BuildRequires:  libXrender-devel
 BuildRequires:  make
 %if %{with nas}
 BuildRequires:  nas-devel
 %endif
 %ifarch %{ix86}
 BuildRequires:  nasm
 %endif
 BuildRequires:  pulseaudio-libs-devel
 %if %{with esound}
 BuildRequires:  sed
 %endif
 # Autotools
 BuildRequires:  automake
 BuildRequires:  autoconf
 BuildRequires:  libtool
 %description
 Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed
 to provide fast access to the graphics frame buffer and audio device.
 %package devel
 Summary:    Files needed to develop Simple DirectMedia Layer applications
 Requires:   SDL%{?_isa} = %{version}-%{release}
 Requires:   alsa-lib-devel
 Requires:   mesa-libGL-devel
 Requires:   mesa-libGLU-devel
 Requires:   libX11-devel
 Requires:   libXext-devel
 Requires:   libXrandr-devel
 Requires:   libXrender-devel
 %description devel
 Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed
 to provide fast access to the graphics frame buffer and audio device. This
 package provides the libraries, include files, and other resources needed for
 developing SDL applications.
 %package static
 Summary:    Files needed to develop static Simple DirectMedia Layer applications
 Requires:   SDL-devel%{?_isa} = %{version}-%{release}
 %description static
 Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed
 to provide fast access to the graphics frame buffer and audio device. This
 package provides the static libraries needed for developing static SDL
 applications.
 %prep
 %setup -q -b0
 %patch0 -p1
 %patch1 -p0
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
 %patch6 -p1
 %patch7 -p1
 %patch8 -p1
 %patch9 -p1
 %patch10 -p1
 %patch11 -p1
 %patch12 -p1
 %patch13 -p1
 %patch14 -p1
 %patch15 -p1
 %patch16 -p1
 %patch17 -p1
 %patch18 -p1
 %patch19 -p1
 %patch20 -p1
 %patch21 -p1
 for F in CREDITS; do 
    iconv -f iso8859-1 -t utf-8 < "$F" > "${F}.utf"
    touch --reference "$F" "${F}.utf"
    mv "${F}.utf" "$F"
 done
 %if %{without esound}
 # Compilation without ESD
 sed -i -e 's/.*AM_PATH_ESD.*//' configure.in
 %endif
 # Update config.sub to support aarch64, bug #926510
 cp -p /usr/share/automake-*/config.{sub,guess} build-scripts
 %build
 aclocal
 libtoolize
 autoconf
 %configure \
    --disable-video-svga \
    --disable-video-ggi \
    --disable-video-aalib \
    --enable-sdl-dlopen \
 %if %{with arts}
    --enable-arts-shared \
 %else
    --disable-arts \
 %endif
 %if %{with esound}
    --enable-esd-shared \
 %else
    --disable-esd \
 %endif
 %if %{with nas}
    --enable-nas-shared \
 %else
    --disable-nas \
 %endif
    --enable-pulseaudio-shared \
    --enable-alsa \
    --disable-video-ps3 \
    --disable-rpath
 make %{?_smp_mflags}
 %install
 make install DESTDIR=%{buildroot}
 # Rename SDL_config.h to SDL_config-<arch>.h to avoid file conflicts on
 # multilib systems and install SDL_config.h wrapper
 mv %{buildroot}/%{_includedir}/SDL/SDL_config.h %{buildroot}/%{_includedir}/SDL/SDL_config-%{_arch}.h
 install -m644 %{SOURCE1} %{buildroot}/%{_includedir}/SDL/SDL_config.h
 # remove libtool .la file
 rm -f %{buildroot}%{_libdir}/*.la
 %post -p /sbin/ldconfig
 %postun -p /sbin/ldconfig
 %files
 %license COPYING
 %doc BUGS CREDITS README-SDL.txt
 %{_libdir}/lib*.so.*
 %files devel
 %doc README docs.html docs/html docs/index.html TODO WhatsNew
 %{_bindir}/*-config
 %{_libdir}/lib*.so
 %{_libdir}/pkgconfig/sdl.pc
 %{_includedir}/SDL
 %{_datadir}/aclocal/*
 %{_mandir}/man1/*
 %{_mandir}/man3/SDL*.3*
 %files static
 %{_libdir}/lib*.a
 %changelog
 * Tue Dec 15 2020 Wim Taymans <wtaymans@redhat.com> - 1.2.15-39
 - copy config.{sub,guess} from /usr/share/automake
 - Resolves: rhbz#1907503
 * Mon Mar 23 2020 Wim Taymans <wtaymans@redhat.com> - 1.2.15-38
 - fix CVEs
 - Resolves: rhbz#1716209, rhbz#1716210, rhbz#1716211, rhbz#1716212,
            rhbz#1716213, rhbz#1716214, rhbz#1716215, rhbz#1716216,
 	    rhbz#1716217, rhbz#1716218, rhbz#1716219
 * Thu Nov 21 2019 Wim Taymans <wtaymans@redhat.com> - 1.2.15-37
 - Rebuild
 - Resolves: rhbz#1756279
 * Fri Aug 30 2019 Petr Pisar <ppisar@redhat.com> - 1.2.15-36
 - Fix CVE-2019-13616 (a heap buffer over-read in BlitNtoN) (bug #1747237)
 - Resolves: rhbz#1756279
 * Mon May 27 2019 Wim Taymans <wtaymans@redhat.com> - 1.2.15-35
 - Rebuild after gating
 - Resolves: rhbz#1602687
 * Tue Apr 30 2019 Wim Taymans <wtaymans@redhat.com> - 1.2.15-34
 - Rebuild
 - Resolves: rhbz#1602687
 * Mon Apr 29 2019 Wim Taymans <wtaymans@redhat.com> - 1.2.15-33
 - Small fixes for problems found by coverity
 - Resolves: rhbz#1602687
 * Thu Aug 16 2018 Wim Taymans <wtaymans@redhat.com> - 1.2.15-32
 - Fix wrong fall throughs in cdrom
 - Resolves: rhbz#1602687
 * Tue Jul 17 2018 Wim Taymans <wtaymans@redhat.com> - 1.2.15-31
 - Remove obsolete audiofile-devel BR
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.15-30
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 * Tue Sep 19 2017 Petr Pisar <ppisar@redhat.com> - 1.2.15-29
 - Fix vec_perm() usage on little-endian 64-bit PowerPC (bug #1392465)
 * Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.15-28
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 * Sun Jul 30 2017 Florian Weimer <fweimer@redhat.com> - 1.2.15-27
 - Rebuild with binutils fix for ppc64le (#1475636)
 * Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.15-26
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
 * Tue Jul 25 2017 Petr Pisar <ppisar@redhat.com> - 1.2.15-25
 - Rebuild with newer GCC to fix miscompilation on PowerPC (bug #1427880)
 * Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.15-24
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 * Tue Jan 10 2017 Petr Pisar <ppisar@redhat.com> - 1.2.15-23
 - Enable setting gamma by programing palette as supported by xorg-server
  1.19.0 again (bug #891973)
 * Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.15-21
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
 * Thu Oct 22 2015 Petr Pisar <ppisar@redhat.com> - 1.2.15-20
 - Enable support for ESound
 * Fri Sep 04 2015 Michal Toman <mtoman@fedoraproject.org> - 1.2.15-19
 - Add support for MIPS architecture to SDL_config.h
 - Disable support for ESound
 * Tue Jun 16 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.15-18
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
 * Fri Aug 15 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.15-17
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
 * Mon Aug 04 2014 Petr Pisar <ppisar@redhat.com> - 1.2.15-16
 - Fix processing keyboard events if SDL_EnableUNICODE() is enabled
  (bug #1126136)
 * Fri Jun 06 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.15-15
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
 * Fri Mar 07 2014 Petr Pisar <ppisar@redhat.com> - 1.2.15-14
 - Do not harness backing store by default. Export SDL_VIDEO_X11_BACKINGSTORE
  environment variable to enable it. (bug #1073057)
 * Fri Jan 17 2014 Petr Pisar <ppisar@redhat.com> - 1.2.15-13
 - Add support for ppc64le architecture (bug #1054397)
 * Thu Dec 05 2013 Petr Pisar <ppisar@redhat.com> - 1.2.15-12
 - Ignore joystick axis events if they aren't in a sane range (bug #990677)
 * Tue Jul 30 2013 Petr Pisar <ppisar@redhat.com> - 1.2.15-11
 - Fix a typo in controlling NAS support
 * Fri Jul 26 2013 Petr Pisar <ppisar@redhat.com> - 1.2.15-10
 - Add esound and arts support (bug #851349)
 - Add NAS support
 * Wed Jun 19 2013 Petr Pisar <ppisar@redhat.com> - 1.2.15-9
 - Add sdl-config(1) manual page (bug #948864)
 * Thu May 23 2013 Petr Pisar <ppisar@redhat.com> - 1.2.15-8
 - Update header files to support aarch64 (bug #966115)
 * Wed Mar 27 2013 Petr Pisar <ppisar@redhat.com> - 1.2.15-7
 - Update config.sub to support aarch64 (bug #926510)
 - Adapt to libX11-1.5.99.901
 * Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.15-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
 * Wed Jan 23 2013 Petr Pisar <ppisar@redhat.com> - 1.2.15-5
 - Work around bug in Xorg to allow changing gamma on X11 (bug #891973)
 * Mon Sep 10 2012 Petr Pisar <ppisar@redhat.com> - 1.2.15-4
 - GL and GLU headers have been moved to mesa-GL-devel and mesa-GLU-devel
 * Thu Aug 23 2012 Matthias Clasen <mclasen@redhat.com> - 1.2.15-3
 - Drop esound and arts support (bug #851349)
 * Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.15-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
 * Thu Feb 23 2012 Petr Pisar <ppisar@redhat.com> - 1.2.15-1
 - Beautify spec code
 - 1.2.15 bump
 * Thu Jan 19 2012 Petr Pisar <ppisar@redhat.com> - 1.2.14-16
 - Replace my patch with upstream one (bug #782251)
 * Tue Jan 17 2012 Petr Pisar <ppisar@redhat.com> - 1.2.14-15
 - Restore compatibility with libX11-1.4.99.1 (bug #782251)
 * Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.14-14
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
 * Fri Aug 26 2011 Petr Pisar <ppisar@redhat.com> - 1.2.14-13
 - Don't block SDL_WM_GrabInput() if window is not viewable (bug #480065)
 * Thu Feb 24 2011 Petr Pisar <ppisar@redhat.com> - 1.2.14-12
 - Adapt to nasm-2.09 (bug #678818)
 * Fri Feb 18 2011 Petr Pisar <ppisar@redhat.com> - 1.2.14-11
 - Correct patch application
 - Make intradependecies architecture specific
 * Fri Feb 18 2011 Petr Pisar <ppisar@redhat.com> - 1.2.14-10
 - Do not call memcpy() on overlapping areas (bug #669844)
 * Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.14-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
 * Mon Aug 16 2010 Petr Pisar <ppisar@redhat.com> - 1.2.14-8
 - Kernel joystick structure has grown in unknown 2.6 Linux version (rh624241,
  sdl900)
 * Thu Aug 12 2010 Petr Pisar <ppisar@redhat.com> - 1.2.14-7
 - Fix left button press event in windowed mode (rh556608, sdl894)
 - Remove unrecognized --disable-debug and --enable-dlopen configure options
  (rh581056)
 * Mon Aug 02 2010 Petr Pisar <ppisar@redhat.com> - 1.2.14-6
 - Make repacked source tar ball relative
 - Remove useless src/joystick/darwin/10.3.9-FIX/IOHIDLib.h because of APSL-2.0
  license
 - Apply SDL-1.2.14-xio_error-rh603984.patch (rh603984, sdl1009)
 - Escape spec file comments
 - Convert CREDITS to UTF-8
 * Wed Jun 23 2010 Hans de Goede <hdegoede@redhat.com> 1.2.14-5
 - Don't crash when trying to exit because of an xio-error (rh603984, sdl1009)
 * Wed Mar 24 2010 Thomas Woerner <twoerner@redhat.com> 1.2.14-4
 - added repackage.sh script to remove joyos2,h and symbian.zip because of
  licensing problems
 - added comment about riva_mmio.h license
 * Tue Feb 16 2010 Josh Boyer <jwboyer@gmail.com> 1.2.14-3
 - disable ps3 video support that was added in 2.14.  It fails to
  build on ppc/ppc64
 * Fri Feb 12 2010 Thomas Woerner <twoerner@redhat.com> 1.2.14-2
 - fixed build for libtool 2.2.6 in F-13 (rhbz#555501)
 * Tue Oct 27 2009 Thomas Woerner <twoerner@redhat.com> 1.2.14-1
 - new version 1.2.14
 - dropped patches for upstream fixes: libdir, dynamic-esd, x11dyn64,
  dynamic-pulse, pa-rewrite, rh484362 and rh487720
 * Fri Jul 24 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.13-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
 * Tue Apr  7 2009 Thomas Woerner <twoerner@redhat.com> 1.2.13-9
 - fixed qemu-kvm segfaults on startup in SDL_memcpyMMX/SSE (rhbz#487720)
  upstream patch
 * Mon Feb 23 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.13-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
 * Fri Feb 13 2009 Hans de Goede <hdegoede@redhat.com> 1.2.13-7
 - Rewrite pulseaudio support to stop the crackle crackle with the
  new glitch free pulseaudio, this also gives us much better latency,
  as good as with directly using alsa (rh 474745, sdl 698)
 - Workaround an obscure bug in the inline-asm revcpy function (by disabling it) 
  This fixes Ri-li crashing on i386 (rh 484121, rh 484362, sdl 699)
 * Tue Sep  2 2008 Thomas Woerner <twoerner@redhat.com> 1.2.13-6
 - dropped pulseaudio hack (rhbz#448270)
 - pulseaudio is now used by default
 - simplified spec file for new architecture support (rhbz#433618)
 * Mon Jul 14 2008 Tom "spot" Callaway <tcallawa@redhat.com> 1.2.13-5
 - fix license tag
 * Wed May 28 2008 Dennis Gilmore <dennis@ausil.us> 1.2.13-4
 - fix sparc multilib handling
 * Mon Apr  7 2008 Thomas Woerner <twoerner@redhat.com> 1.2.13-3
 - updated PulseAudio driver (rhbz#439847)
  Thanks to Lennart Poettering for the patch
 * Fri Feb  1 2008 Thomas Woerner <twoerner@redhat.com> 1.2.13-2
 - new static sub package for static libraries
 * Mon Jan  7 2008 Thomas Woerner <twoerner@redhat.com> 1.2.13-1
 - new version 1.2.13
  - fixes i810 video overlay problem (rhbz#310841)
  - fixes c++ style comments in header files (rhbz#426475)
 - review fixes: spec file cleanup, dropped static libs (rhbz#226402)
 - fixed pulseaudio hack scripts from Warren for multilib systems (rhbz#426579)
 - fixed pulseaudio detection in configure to enable dynamic use of pulseaudio
  libraries
 * Fri Dec 21 2007 Warren Togami <wtogami@redhat.com> 1.2.12-5
 - correct stupid mistake that broke SDL-devel
  RPM should error out if a SourceX is defined twice...
 * Wed Dec 19 2007 Warren Togami <wtogami@redhat.com> 1.2.12-4
 - Build with --enable-pulseaudio-shared for testing purposes (#343911)
  It is known to not work in some cases, so not enabled by default.
 - Move pulseaudio enabler hack from SDL_mixer (#426275)
 - Make pulseaudio enabler hack conditional.  It will only attempt to use it if
  alsa-plugins-pulseaudio is installed.
 * Tue Nov  6 2007 Thomas Woerner <twoerner@redhat.com> 1.2.12-3
 - fixed latest multiarch conflicts: dropped libdir from sdl-config completely
  (rhbz#343141)
 * Tue Aug 28 2007 Thomas Woerner <twoerner@redhat.com> 1.2.12-2
 - use uname -m in multilib patch instead of arch
 * Mon Aug 27 2007 Thomas Woerner <twoerner@redhat.com> 1.2.12-1
 - new version 1.2.12
  fixes TEXTRELs (rhbz#179407)
 - added arm support (rhbz#245411)
  Thanks to Lennert Buytenhek for the patch
 - added alpha support (rhbz#246463)
  Thanks to Oliver Falk for the patch
 - disabled yasm for SDL (rhbz#234823)
  Thanks to Nikolay Ulyanitsky for the patch
 * Tue Mar 20 2007 Thomas Woerner <twoerner@redhat.com> 1.2.11-2
 - use X11 dlopen code for 64 bit architectures (rhbz#207903)
 * Mon Mar 19 2007 Thomas Woerner <twoerner@redhat.com> 1.2.11-1
 - new version 1.2.11
 - fixed man page SDL_ListModes (rhbz#208212)
 - fixed spurious esound, audiofile dependencies (rhbz#217389)
  Thanks to Ville Skyttä for the patch
 - dropped requirements for imake and libXt-devel (rhbz#226402)
 - made nasm arch %%{ix86} only (rhbz#226402)
 - dropped O3 from options (rhbz#226402)
 - dropped tagname environment variable (rhbz#226402)
 * Thu Nov  2 2006 Thomas Woerner <twoerner@redhat.com> 1.2.10-9
 - fixed arch order in SDL_config.h wrapper
 * Fri Oct 27 2006 Thomas Woerner <twoerner@redhat.com> 1.2.10-8
 - fixed multilib conflicts for SDL (#212288)
 * Wed Jul 26 2006 Thomas Woerner <twoerner@redhat.com> 1.2.10-6.2
 - setting the X11 lib and include paths hard to get shared X11 support on all
  architectures
 * Wed Jul 26 2006 Thomas Woerner <twoerner@redhat.com> 1.2.10-6.1
 - added build requires for automake and autoconf
 * Tue Jul 25 2006 Thomas Woerner <twoerner@redhat.com> 1.2.10-6
 - dropped libXt build requires, because libSDL does not need libXt at all - 
  this was an autofoo bug (fixed already)
 - fixed multilib devel conflicts (#192749)
 - added buidrequires for imake: AC_PATH_X needs imake currently
 * Wed Jul 12 2006 Jesse Keating <jkeating@redhat.com> - 1.2.10-5
 - rebuild
 - use %%configure macro
 * Tue Jun 20 2006 Christopher Stone <chris.stone@gmail.com> 1.2.10-4
 - added missing (build) requires for libXt libXrender libXrandr
 - remove %%makeinstall macro (bad practice)
 - use %%{buildroot} macro consistantly
 * Tue Jun  6 2006 Thomas Woerner <twoerner@redhat.com> 1.2.10-2
 - added missing (build) requires for GL and GLU
 * Mon May 22 2006 Thomas Woerner <twoerner@redhat.com> 1.2.10-1
 - new version 1.2.10
 - dropped the following patches because they are not needed anymore:
  ppc_modes, gcc4, yuv_mmx_gcc4 and no_exec_stack
 - new pagesize patch (drop PAGE_SIZE, use sysconf(_SC_PAGESIZE) instead)
 * Mon Feb 13 2006 Jesse Keating <jkeating@redhat.com> - 1.2.9-5.2.1
 - rebump for build order issues during double-long bump
 * Fri Feb 10 2006 Jesse Keating <jkeating@redhat.com> - 1.2.9-5.2
 - bump again for double-long bug on ppc(64)
 * Tue Feb 07 2006 Jesse Keating <jkeating@redhat.com> - 1.2.9-5.1
 - rebuilt for new gcc4.1 snapshot and glibc changes
 * Fri Jan 27 2006 Thomas Woerner <twoerner@redhat.com> 1.2.9-5
 - added upstream no exec stack patch
 * Thu Jan 26 2006 Thomas Woerner <twoerner@redhat.com> 1.2.9-4
 - prefer alsa sound output, then artsd and esd
 * Tue Jan 24 2006 Thomas Woerner <twoerner@redhat.com> 1.2.9-3
 - dropped libtool .la files from devel package
 * Fri Dec 09 2005 Jesse Keating <jkeating@redhat.com>
 - rebuilt
 * Wed Nov 16 2005 Thomas Woerner <twoerner@redhat.com> 1.2.9-2.1
 - fixed build requires
 * Tue Nov 15 2005 Warren Togami <wtogami@redhat.com> 1.2.9-2
 - -devel req actual X libs
 * Mon Nov  7 2005 Thomas Woerner <twoerner@redhat.com> 1.2.9-1
 - new version 1.2.9 with additional gcc4 fixes
 - using xorg-x11-devel instead of XFree86-devel
 * Thu May 26 2005 Bill Nottingham <notting@redhat.com> 1.2.8-3.2
 - fix configure script for libdir so library deps are identical on all
  arches (#158346)
 * Thu Apr 14 2005 Thomas Woerner <twoerner@redhat.com> 1.2.8-3.1
 - new version of the gcc4 fix
 * Tue Apr 12 2005 Thomas Woerner <twoerner@redhat.com> 1.2.8-3
 - fixed gcc4 compile problems
 - fixed x86_64 endian problem
 * Wed Feb  9 2005 Thomas Woerner <twoerner@redhat.com> 1.2.8-2
 - rebuild
 * Fri Dec 17 2004 Thomas Woerner <twoerner@redhat.com> 1.2.8-1
 - new version 1.2.8
 * Thu Oct 14 2004 Thomas Woerner <twoerner@redhat.com> 1.2.7-8
 - added patch from SDL CVS for arts detection/initialization problem (#113831)
 * Wed Sep 29 2004 Thomas Woerner <twoerner@redhat.com> 1.2.7-7.1
 - moved to new autofoo utils
 * Fri Jul  9 2004 Thomas Woerner <twoerner@redhat.com> 1.2.7-7
 - fixed resolution switching for ppc (#127254)
 * Mon Jun 21 2004 Thomas Woerner <twoerner@redhat.com> 1.2.7-6
 - fixed gcc34 build problems
 * Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>
 - rebuilt
 * Mon May 24 2004 Thomas Woerner <twoerner@redhat.com> 1.2.7-4
 - added requires for alsa-lib-devel (#123374)
 * Wed Mar 31 2004 Harald Hoyer <harald@redhat.com> - 1.2.7-3
 - fixed gcc34 compilation issues
 * Wed Mar 10 2004 Thomas Woerner <twoerner@redhat.com> 1.2.7-2.1
 - added buildrequires for alsa-lib-devel
 - now using automake 1.5
 * Tue Mar  9 2004 Thomas Woerner <twoerner@redhat.com> 1.2.7-2
 - Fixed SDL requires for devel package
 * Tue Mar 02 2004 Elliot Lee <sopwith@redhat.com>
 - rebuilt
 - Revive SDL-ppc64.patch
 * Mon Mar  1 2004 Thomas Woerner <twoerner@redhat.com> 1.2.7-1
 - new version 1.2.7
 * Fri Feb 13 2004 Elliot Lee <sopwith@redhat.com>
 - rebuilt
 * Thu Feb  5 2004 Thomas Woerner <twoerner@redhat.com> 1.2.6-3.1
 - disabled several video modes, hopefuilly fixes (#113831)
 * Thu Jan 29 2004 Thomas Woerner <twoerner@redhat.com> 1.2.6-3
 - fix for alsa 1.0
 * Tue Nov 25 2003 Thomas Woerner <twoerner@redhat.com> 1.2.6-2
 - removed rpath
 - using O3 instead of O2, now (SDL_RLEaccel.c compile error)
 - added BuildRequires for nasm
 * Tue Sep  2 2003 Thomas Woerner <twoerner@redhat.com> 1.2.6-1
 - new version 1.2.6
 * Thu Aug  7 2003 Elliot Lee <sopwith@redhat.com> 1.2.5-9
 - Fix libtool
 * Wed Jun 04 2003 Elliot Lee <sopwith@redhat.com>
 - rebuilt
 * Wed Jun  4 2003 Than Ngo <than@redhat.com> 1.2.5-7
 - fix build problem with gcc 3.3
 - clean up specfile
 * Mon May 19 2003 Thomas Woerner  <twoerner@redhat.com> 1.2.5-5
 - rebuild
 * Tue Apr 15 2003 Thomas Woerner  <twoerner@redhat.com> 1.2.5-4
 - X11 modes fix (use more than 60 Hz, when possible)
 * Mon Feb 17 2003 Elliot Lee <sopwith@redhat.com> 1.2.5-3.5
 - ppc64 fix
 * Mon Feb 10 2003 Thomas Woerner  <twoerner@redhat.com> 1.2.5-3
 - added -fPIC to LDFLAGS
 * Wed Jan 22 2003 Tim Powers <timp@redhat.com>
 - rebuilt
 * Tue Dec 10 2002 Thomas Woerner <twoerner@redhat.com> 1.2.5-1
 - new version 1.2.5
 - disabled conflicting automake16 patch
 - dgavideo modes fix (#78861)
 * Sun Dec 01 2002 Elliot Lee <sopwith@redhat.com> 1.2.4-7
 - Fix unpackaged files by including them.
 - _smp_mflags
 * Fri Nov 29 2002 Tim Powers <timp@redhat.com> 1.2.4-6
 - remove unpackaged files from the buildroot
 - lib64'ize
 * Sat Jul 20 2002 Florian La Roche <Florian.LaRoche@redhat.de>
 - do not require nasm for mainframe
 * Tue Jul  2 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.4-4
 - Fix bug #67255
 * Fri Jun 21 2002 Tim Powers <timp@redhat.com>
 - automated rebuild
 * Sun May 26 2002 Tim Powers <timp@redhat.com>
 - automated rebuild
 * Thu May 23 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.4-1
 - 1.2.4
 - Fix build with automake 1.6
 * Mon Mar 11 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.3-7
 - Fix AM_PATH_SDL automake macro with AC_LANG(c++) (#60533)
 * Thu Feb 28 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.3-6
 - Rebuild in current environment
 * Thu Jan 24 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.3-5
 - dlopen() aRts and esd rather than linking directly to them.
 - make sure aRts and esd are actually used if they're running.
 * Mon Jan 21 2002 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.3-4
 - Don't crash without xv optimization: BuildRequire a version of nasm that
  works.
 * Wed Jan 09 2002 Tim Powers <timp@redhat.com>
 - automated rebuild
 * Mon Dec 17 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.3-2
 - Rebuild with new aRts, require arts-devel rather than kdelibs-sound-devel
 - Temporarily exclude alpha (compiler bugs)
 * Thu Nov 22 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.3-1
 - 1.2.3
 * Sat Nov 17 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.2-5
 - Add workaround for automake 1.5 asm bugs
 * Tue Oct 30 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.2-4
 - Make sure -fPIC is used on all architectures (#55039)
 - Fix build with autoconf 2.5x
 * Fri Aug 31 2001 Bill Nottingham <notting@redhat.com> 1.2.2-3
 - rebuild (fixes #50750??)
 * Thu Aug  2 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.2-2
 - SDL-devel should require esound-devel and kdelibs-sound-devel (#44884)
 * Tue Jul 24 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.2-1
 - Update to 1.2.2; this should fix #47941
 - Add build dependencies
 * Tue Jul 10 2001 Elliot Lee <sopwith@redhat.com> 1.2.1-3
 - Rebuild to eliminate libXv/libXxf86dga deps.
 * Fri Jun 29 2001 Preston Brown <pbrown@redhat.com>
 - output same libraries for sdl-config whether --libs or --static-libs 
  selected.  Fixes compilation of most SDL programs.
 - properly packaged new HTML documentation
 * Sun Jun 24 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.1-1
 - 1.2.1
 * Mon May  7 2001 Bernhard Rosenkraenzer <bero@redhat.com> 1.2.0-2
 - Add Bill's byteorder patch
 * Sun Apr 15 2001 Bernhard Rosenkraenzer <bero@redhat.com>
 - 1.2.0
 * Tue Feb 27 2001 Karsten Hopp <karsten@redhat.de>
 - SDL-devel requires SDL
 * Tue Jan 16 2001 Bernhard Rosenkraenzer <bero@redhat.com>
 - Require arts rather than kdelibs-sound
 * Sun Jan  7 2001 Bernhard Rosenkraenzer <bero@redhat.com>
 - 1.1.7
 * Tue Oct 24 2000 Bernhard Rosenkraenzer <bero@redhat.com>
 - 1.1.6
 * Mon Aug  7 2000 Bernhard Rosenkraenzer <bero@redhat.com>
 - build against new DGA
 - update to 1.1.4, remove patches (they're now in the base release)
 * Tue Aug  1 2000 Bernhard Rosenkraenzer <bero@redhat.com>
 - %%post -p /sbin/ldconfig (Bug #14928)
 - add URL
 * Wed Jul 12 2000 Prospector <bugzilla@redhat.com>
 - automatic rebuild
 * Sun Jun 18 2000 Bill Nottingham <notting@redhat.com>
 - replace patch that fell out of SRPM
 * Tue Jun 13 2000 Preston Brown <pbrown@redhat.com>
 - FHS paths
 - use 1.1 (development) version; everything even from Loki links to it!
 * Thu May  4 2000 Bill Nottingham <notting@redhat.com>
 - autoconf fixes for ia64
 * Mon Apr 24 2000 Tim Powers <timp@redhat.com>
 - updated to 1.0.8
 * Tue Feb 15 2000 Tim Powers <timp@redhat.com>
 - updated to 1.0.4, fixes problems when run in 8bpp
 * Tue Feb 01 2000 Tim  Powers <timp@redhat.com>
 - applied patch from Hans de Goede <hans@highrise.nl> for fullscreen toggling.
 - using  --enable-video-x11-dgamouse since it smoothes the mouse some.
 * Sun Jan 30 2000 Tim Powers <timp@redhat.com>
 - updated to 1.0.3, bugfix update
 * Fri Jan 28 2000 Tim Powers <timp@redhat.com>
 - fixed group etc
 * Fri Jan 21 2000 Tim Powers <timp@redhat.com>
 - build for 6.2 Powertools
 * Wed Jan 19 2000 Sam Lantinga <slouken@devolution.com>
 - Re-integrated spec file into SDL distribution
 - 'name' and 'version' come from configure 
 - Some of the documentation is devel specific
 - Removed SMP support from %%build - it doesn't work with libtool anyway
 * Tue Jan 18 2000 Hakan Tandogan <hakan@iconsult.com>
 - Hacked Mandrake sdl spec to build 1.1
 * Sun Dec 19 1999 John Buswell <johnb@mandrakesoft.com>
 - Build Release
 * Sat Dec 18 1999 John Buswell <johnb@mandrakesoft.com>
 - Add symlink for libSDL-1.0.so.0 required by sdlbomber
 - Added docs
 * Thu Dec 09 1999 Lenny Cartier <lenny@mandrakesoft.com>
 - v 1.0.0
 * Mon Nov  1 1999 Chmouel Boudjnah <chmouel@mandrakesoft.com>
 - First spec file for Mandrake distribution.
 # end of file
--- a/dead.package.c9s
+++ b/dead.package.c9s
@ -1 +0,0 @@
 SDL package is retired for CS-1077
		`@ -0,0 +1 @@`
							`61a0c4976ecc88d1101f1d03105089588d167a40 SOURCES/SDL-1.2.15_repackaged.tar.gz`