I reviewed libsdl3 3.4.10+ds-1 as checked into stonking. This shouldn't be
considered a full audit but rather a quick gauge of maintainability.
libsdl3 is the Simple DirectMedia Layer 3, a cross-platform C library
(zlib-licensed) providing low-level access to audio, video, input,
joystick, haptics, GPU rendering, threads, timers, and file/async IO
through a unified API. Shipped as `libSDL3.so` (no daemons/setuid/network
listeners); ~330k LOC C; successor to SDL2, actively developed upstream.
- CVE History
- None for libsdl3 (new source package; osv-scanner reports 0
vulnerabilities)
- SDL2's 19 CVEs checked for cross-applicability: SDL3 evolved from the
same codebase after all fixes, therefore none of the CVEs affect
libsdl3. Also, majority of SDL2's CVEs were fixed
- the 2019 batch (13 CVEs) was fixed via USN-4156, no regressions
- CVE-2017-2888 fixed via USN-4143-1, no regressions
- CVE-2020-14409/14410 fixed via USN-5274-1, no regressions
- CVE-2021-33657 fixed via USN-5398-1, no regressions
- CVE-2022-34568 is SDL 1.2 only (not applicable to libsdl2)
- CVE-2022-4743 (GLES memleak) is marked as "unlikely to be
exploitable" (low priority)
- Build-Depends
- debhelper-compat 13 + CMake/Ninja; build-deps are system
multimedia/display/input/GPU libraries; no crypto or networking
build-deps; no sensitive library exposure
- libdbus-1-dev is the only IPC surface (desktop IME ibus/fcitx
integration, not privileged services)
- hardening well configured (+bindnow, -fstack-protector-strong,
-fcf-protection, -Werror=format-security, -D_FORTIFY_SOURCE=3)
- dh-sequence-dlopenlibdeps auto-derives runtime dlopen dependencies
- pre/post inst/rm scripts
- None
- init scripts
- None
- systemd units
- None
- dbus services
- None
- setuid binaries
- None (upstream README warns SDL must not be used in
setuid/setgid/setcap programs as it does not sanitize inherited
environment variables)
- binaries in PATH
- None (libsdl3-tests ships ELF files only under
/usr/libexec/installed-{examples,tests}, not in PATH)
- sudo fragments
- None
- polkit files
- None
- udev rules
- None (SDL3 links libudev for runtime device enumeration only; SDL2's
joystick/gamepad rules are not carried over)
- unit tests / autopkgtests
- large test suite (183 entries): build-time ctest 25/25 passed, no
failures; good test coverage
- 4 autopkgtests: build, cmake (smoke), installed-tests (full suite),
flaky (testtimer, amd64/arm64/i386 only)
- cron jobs
- None
- Build logs
- clean build; 0 compiler errors, 0 compiler warnings
- 24 warning lines all non-compiler noise (doxygen, dpkg/sbuild
infrastructure, ca-certificates rehash, xargs)
- Processes spawned
- process API uses posix_spawnp() + vfork(), argv-array based (no shell,
no system()/popen()); no shell-injection surface
- dynapi uses dlopen() for the dynamic-API override path
(src/dynapi/SDL_dynapi.c:478; Coverity flagged a handle leak, no
dlclose after dlsym; low impact, bootstrap path only)
- Memory management
- manual malloc/free throughout (own Doug-Lea allocator);
SDL_malloc/calloc/realloc/free wrappers with return-value checks; no
strcpy/strcat/alloca in source code; no unsafe patterns
- File IO
- fixed device paths (/dev/tty, /dev/urandom, evdev/hidraw; O_CLOEXEC),
XDG dirs, or app-supplied; SDL doesn't sanitize app paths by design
(library, not privileged broker); not a concern for a non-privileged
library
- Logging
- SDL_Log* uses SDL_vsnprintf internally (bounded output); format
strings are compile-time constants; no tainted format-string risk
- Environment variable usage
- many environment variables read via SDL_getenv (SDL_VIDEODRIVER, HOME,
XDG_*, etc.); treated as untrusted strings, never passed to shell; no
injection risk
- upstream warns SDL must not be used in setuid/setgid/setcap programs
(does not sanitize inherited environment variables)
- Use of privileged functions
- no setuid/setgid/chroot/iopl/ioperm calls; SDL refuses to load GTK
when setuid/setgid is used (src/core/unix/SDL_gtk.c:130-137)
- ioctl() calls are on already-open device fds for hardware access the
app already has permission to use; no privilege escalation
- Use of cryptography / random number sources etc
- no TLS/certificate/general-purpose cryptography; PRNG is a
non-cryptographic LCG (SDL_rand, seeded from
SDL_GetPerformanceCounter()); acceptable for games, not used for
security purposes; /dev/urandom only in malloc hardening
- Use of temp files
- tray icon uses g_mkdtemp (safe, atomic, unpredictable name);
Emscripten /tmp/filedrop is WASM in-memory FS; no mktemp/tmpnam races;
no temp-file vulnerability risk
- Use of networking
- None
- Use of WebKit
- None
- Use of PolicyKit
- None
- Any significant cppcheck results
- 213 warnings, but the bulk are unknownMacro/syntaxError false
positives from SDL's custom macros and Emscripten JS-in-C files; no
real defects
- 41 uninitvar in Wayland/PipeWire backends (mostly false positives from
listener-populated structs); 5 returnDanglingLifetime in x11
GL/clipboard code (benign by API contract); no exploitable finding in
the Linux core build
- Any significant Coverity results
- 15,317 defects but ~98% are noise from SDL's macro-heavy code; ~30
real findings after dedup and test exclusion
- SDL_x11keyboard.c:634/644 FORWARD_NULL; null dereference in XIM
preedit handling, triggerable via X11 input methods; externally
reachable via a malicious or buggy IME; reported upstream
- src/libm/k_rem_pio2.c:245-307 OVERRUN (15 sites); vendored NetBSD
FDLIBM trig reduction, bounded-array access, not reachable from
untrusted input; low risk
- src/thread/SDL_thread.c:243 LOCK_EVASION; TLS double-checked- locking
race; concurrency correctness issue; low impact
- src/dynapi/SDL_dynapi.c:478 RESOURCE_LEAK; dlopen handle leaked in
dynapi bootstrap; low impact (one-time bootstrap path)
- SDL_hidapi_zuiki.c:67/74 INTEGER_OVERFLOW; Coverity flags mf->count as
device-tainted, but count is an internal counter managed by
median_filter_update itself (not device-supplied); false positive
- SDL_audioresample.c:483 DIVIDE_BY_ZERO; Coverity flags divide by
BesselI0(), but the input (dB=80.0) is a hardcoded constant and
BesselI0(7.857) always returns ~440.5; false positive
- SDL_gpu_vulkan.c:1362/1370 INTEGER_OVERFLOW; unsigned underflow in
Vulkan allocator free-region bookkeeping; not externally reachable
(requires attacker to already control the app's Vulkan allocation
patterns); not a realistic attack vector
- remaining INTEGER_OVERFLOWs (cpuinfo sysconf, hidapi_gip axis, time
conversion) are low-risk or platform-specific
- 45 UNINIT findings are all va_list-before-va_start (known Coverity
false positive); not real defects
- Any significant shellcheck results
- 175 warnings, all in build/dev-time shell scripts (build-scripts/,
metal shaders, debian/tests/cmake); no runtime shell ships with the
library; no impact
- Any significant bandit results
- 96 warnings, all in build-scripts/build-release.py (release packaging
helper, not shipped); no Python in the runtime package ; no impact
- Any significant govulncheck results
- N/A
- Any significant Semgrep results
- None
libsdl3 bundles vendored code (src/libm FDLIBM, src/hidapi) which are
separate CVE-tracking burdens. It dlopens audio/video/input backends at
runtime via the dynamic-API path, expanding the maintenance surface. The
real Coverity findings are localized and reported upstream.
Security team ACK for promoting libsdl3 to main.
** CVE added: https://cve.org/CVERecord?id=CVE-2017-2888
** CVE added: https://cve.org/CVERecord?id=CVE-2020-14409
** CVE added: https://cve.org/CVERecord?id=CVE-2021-33657
** CVE added: https://cve.org/CVERecord?id=CVE-2022-34568
** CVE added: https://cve.org/CVERecord?id=CVE-2022-4743
** Changed in: libsdl3 (Ubuntu)
Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2155439
Title:
[MIR] Promote libsdl3
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libsdl3/+bug/2155439/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
