diff options
| author | Christoph M. Becker <cmb@php.net> | 2015-07-20 23:24:55 +0200 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-06-13 08:10:36 +0200 |
| commit | f96ebb098697908641c6d37e1149cde1f90417fd (patch) | |
| tree | 3e7341a8aa22fde9246e89e809fa7dff59cf2f05 | |
| parent | 4dd03651f3c90a754600e9b76e33c9481bd9e720 (diff) | |
| download | php-git-f96ebb098697908641c6d37e1149cde1f90417fd.tar.gz | |
Fix #66387: Stack overflow with imagefilltoborder
The stack overflow is caused by the recursive algorithm in combination with a
very large negative coordinate passed to gdImageFillToBorder(). As there is
already a clipping for large positive coordinates to the width and height of
the image, it seems to be consequent to clip to zero also.
| -rw-r--r-- | ext/gd/libgd/gd.c | 4 | ||||
| -rw-r--r-- | ext/gd/tests/bug66387.phpt | 15 |
2 files changed, 19 insertions, 0 deletions
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index d73f0943af..2c63aac4cd 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -1774,9 +1774,13 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color) if (x >= im->sx) { x = im->sx - 1; + } else if (x < 0) { + x = 0; } if (y >= im->sy) { y = im->sy - 1; + } else if (y < 0) { + y = 0; } for (i = x; i >= 0; i--) { diff --git a/ext/gd/tests/bug66387.phpt b/ext/gd/tests/bug66387.phpt new file mode 100644 index 0000000000..79c49a527b --- /dev/null +++ b/ext/gd/tests/bug66387.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #66387 (Stack overflow with imagefilltoborder) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available!'); +?> +--FILE-- +<?php +$im = imagecreatetruecolor(20, 20); +$c = imagecolorallocate($im, 255, 0, 0); +imagefilltoborder($im, 0, -999355, $c, $c); +echo "ready\n"; +?> +--EXPECT-- +ready |