diff options
| author | Anatol Belski <ab@php.net> | 2016-08-16 14:37:39 +0200 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-08-17 13:46:14 +0200 |
| commit | 3493ed5b528be73c73a85c75effdfd3a469ac55d (patch) | |
| tree | f819f93d41b3198b8387c195b54007cabccd1822 | |
| parent | 72d03f8aa460184930cbca3f61de3cec35128e2b (diff) | |
| download | php-git-3493ed5b528be73c73a85c75effdfd3a469ac55d.tar.gz | |
Fix bug#72697 - select_colors write out-of-bounds
(cherry picked from commit b6f13a5ef9d6280cf984826a5de012a32c396cd4)
Conflicts:
ext/gd/gd.c
(cherry picked from commit 28022c9b1fd937436ab67bb3d61f652c108baf96)
| -rw-r--r-- | ext/gd/gd.c | 6 | ||||
| -rw-r--r-- | ext/gd/tests/bug72697.phpt | 17 |
2 files changed, 20 insertions, 3 deletions
diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 3faea954da..27dce95a55 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -1530,11 +1530,11 @@ PHP_FUNCTION(imagetruecolortopalette) RETURN_FALSE; } - if (ncolors <= 0) { - php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero"); + if (ncolors <= 0 || ZEND_LONG_INT_OVFL(ncolors)) { + php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero and no more than %d", INT_MAX); RETURN_FALSE; } - gdImageTrueColorToPalette(im, dither, ncolors); + gdImageTrueColorToPalette(im, dither, (int)ncolors); RETURN_TRUE; } diff --git a/ext/gd/tests/bug72697.phpt b/ext/gd/tests/bug72697.phpt new file mode 100644 index 0000000000..6110385fcb --- /dev/null +++ b/ext/gd/tests/bug72697.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #72697: select_colors write out-of-bounds +--SKIPIF-- +<?php +if (!function_exists("imagecreatetruecolor")) die("skip"); +if (PHP_INT_MAX !== 9223372036854775807) die("skip for 64-bit long systems only"); +?> +--FILE-- +<?php + +$img=imagecreatetruecolor(10, 10); +imagetruecolortopalette($img, false, PHP_INT_MAX / 8); +?> +DONE +--EXPECTF-- +Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than 2147483647 in %sbug72697.php on line %d +DONE
\ No newline at end of file |