diff options
| author | Remi Collet <remi@php.net> | 2014-08-04 10:47:54 +0200 |
|---|---|---|
| committer | Remi Collet <remi@php.net> | 2014-08-04 10:47:54 +0200 |
| commit | a45b8874fbf82f3e618914a0ccfb9df103f31162 (patch) | |
| tree | 11b2511aa7da30c7cd5b76ee612c51837ba860e9 | |
| parent | e0c1fa30c46bb384c099f67e79246082d4faef38 (diff) | |
| parent | d3b5ed078793f2887caede30ccfbadc7f3a6e1a3 (diff) | |
| download | php-git-a45b8874fbf82f3e618914a0ccfb9df103f31162.tar.gz | |
Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
NEWS
Fixed Bug #66901 php-gd 'c_color' NULL pointer dereference
| -rw-r--r-- | ext/gd/libgd/gdxpm.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/ext/gd/libgd/gdxpm.c b/ext/gd/libgd/gdxpm.c index 73f86e5df7..b69414e60d 100644 --- a/ext/gd/libgd/gdxpm.c +++ b/ext/gd/libgd/gdxpm.c @@ -31,12 +31,17 @@ gdImagePtr gdImageCreateFromXpm (char *filename) if (ret != XpmSuccess) { return 0; } + number = image.ncolors; + for(i = 0; i < number; i++) { + if (!image.colorTable[i].c_color) { + goto done; + } + } if (!(im = gdImageCreate(image.width, image.height))) { goto done; } - number = image.ncolors; colors = (int *) safe_emalloc(number, sizeof(int), 0); for (i = 0; i < number; i++) { switch (strlen (image.colorTable[i].c_color)) { |