php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #26722 Segmentation fault (overflow) in /gd/libgd/gd.c (ImageFill)
Submitted: 2003-12-26 14:52 UTC Modified: 2004-01-01 20:47 UTC
From: salesteam at luckylovers dot net Assigned:
Status: No Feedback Package: GD related
PHP Version: 4.3.4 OS: Linux Red Hat 7.3
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: salesteam at luckylovers dot net
New email:
PHP Version: OS:

 

 [2003-12-26 14:52 UTC] salesteam at luckylovers dot net
Description:
------------
php_info(): http://207.44.184.74/test/info.php
GD has been installed with Apache (not with php)

APACHE LOGS:
[Fri Dec 26 12:19:20 2003] [notice] child pid 31265 exit signal Segmentation fault (11)
(on every script execution, memory has been tested OK)


BACKTRACE:
---------------------------------------
/install/php-4.3.3/ext/gd/libgd/gd.c(1913) : Block 0x08191CC8 status:
Beginning:      OK (allocated on /install/php-4.3.3/ext/gd/libgd/gd.c:1876, 17 bytes)
      End:      Overflown (magic=0x00000000 instead of 0x2A8FCC84)
                At least 4 bytes overflown
---------------------------------------
/install/php-4.3.3/ext/gd/libgd/gd.c(1876) :  Freeing 0x08191CEC (17 bytes), script=/usr/local/apache/htdocs/vh/www.luckylover
s.net/htdocs/p/pic.php
[Fri Dec 26 15:46:40 2003]  Script:  '/usr/local/apache/htdocs/vh/www.luckylovers.net/htdocs/p/pic.php'
---------------------------------------

GD PROGRAMM:
(line 1876 is 'stack = (struct seg *)emalloc(sizeof(struct seg) * ((int)(im->sy*im->sx)/4)+1);
')

void gdImageFill(gdImagePtr im, int x, int y, int nc)
{
        int l, x1, x2, dy;
        int oc;   /* old pixel value */
        int wx2,wy2;
        /* stack of filled segments */
        //struct seg stack[FILL_MAX],*sp = stack;;
        struct seg *stack;
        struct seg *sp;

        if (nc==gdTiled){
                _gdImageFillTiled(im,x,y,nc);
                return;
        }

        wx2=im->sx;wy2=im->sy;
        oc = gdImageGetPixel(im, x, y);
        if (oc==nc || x<0 || x>wx2 || y<0 || y>wy2) return;

        stack = (struct seg *)emalloc(sizeof(struct seg) * ((int)(im->sy*im->sx)/4)+1);
        sp = stack;

        /* required! */
        FILL_PUSH(y,x,x,1);
        /* seed segment (popped 1st) */
        FILL_PUSH(y+1, x, x, -1);



Reproduce code:
---------------
$height=2;
$width=2;
$im=ImageCreate($width,$height);
$crem=ImageColorAllocate ($im, 229,228,202);
ImageFill($im, 0,0,$crem);
ImageJpeg($im);
ImageDestroy($im);

THANK YOU FOR YOUR HELP !


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-12-26 15:06 UTC] iliaa@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip

Does not appear to crash with latest CVS snapshot. 
 [2004-01-01 20:47 UTC] sniper@php.net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Apr 28 12:01:28 2024 UTC