SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in video/SDL_blit.c.
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-13616.json"