sdl_image: heap-based buffer overflow in SDL blit functions in video/SDL_blit*.c (CVE-2019-13616)

SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.

References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-13616
• https://bugzilla.libsdl.org/show_bug.cgi?id=4538

Patch:

https://hg.libsdl.org/SDL_image/rev/a59bfe382008

Affected branches:

• master (57df0876bfe6ab49dc759abbde418a91891fc5f4)
• 3.10-stable (41c5bc74)
• 3.9-stable (258d45e7)
• 3.8-stable (e5f827ce)
• 3.7-stable (a50982ce)