diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-08-10 00:14:58 -0700 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-08-17 13:45:14 +0200 |
| commit | bab470f6ba67f5b2e83d8152ae9adee5161a975e (patch) | |
| tree | 02d17371fd0b62e2bacba68b08a96854bdb79476 | |
| parent | b2d89c93e85504ccfcd865213685b89ec1cafcf9 (diff) | |
| download | php-git-bab470f6ba67f5b2e83d8152ae9adee5161a975e.tar.gz | |
Fix bug #72730 - imagegammacorrect allows arbitrary write access
(cherry picked from commit 047fe0ed03093a496691d376fcf51a7e2f1d04b0)
Conflicts:
ext/gd/gd.c
(cherry picked from commit e70069a62fb7252252cad9506fac5baf4ac11d21)
| -rw-r--r-- | ext/gd/gd.c | 5 | ||||
| -rw-r--r-- | ext/gd/tests/bug72730.phpt | 15 |
2 files changed, 20 insertions, 0 deletions
diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 9375aeee1e..3faea954da 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -3032,6 +3032,11 @@ PHP_FUNCTION(imagegammacorrect) return; } + if ( input <= 0.0 || output <= 0.0 ) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive"); + RETURN_FALSE; + } + if ((im = (gdImagePtr)zend_fetch_resource(Z_RES_P(IM), "Image", le_gd)) == NULL) { RETURN_FALSE; } diff --git a/ext/gd/tests/bug72730.phpt b/ext/gd/tests/bug72730.phpt new file mode 100644 index 0000000000..e7c13cb5e9 --- /dev/null +++ b/ext/gd/tests/bug72730.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #72730: imagegammacorrect allows arbitrary write access +--SKIPIF-- +<?php +if (!function_exists("imagecreatetruecolor")) die("skip"); +?> +--FILE-- +<?php +$img = imagecreatetruecolor(1, 1); +imagegammacorrect($img, -1, 1337); +?> +DONE +--EXPECTF-- +Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d +DONE
\ No newline at end of file |