php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #26722 Segmentation fault (overflow) in /gd/libgd/gd.c (ImageFill)
Submitted: 2003-12-26 14:52 UTC Modified: 2004-01-01 20:47 UTC
From: salesteam at luckylovers dot net Assigned:
Status: No Feedback Package: GD related
PHP Version: 4.3.4 OS: Linux Red Hat 7.3
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: salesteam at luckylovers dot net
New email:
PHP Version: OS:

 

 [2003-12-26 14:52 UTC] salesteam at luckylovers dot net
Description:
------------
php_info(): http://207.44.184.74/test/info.php
GD has been installed with Apache (not with php)

APACHE LOGS:
[Fri Dec 26 12:19:20 2003] [notice] child pid 31265 exit signal Segmentation fault (11)
(on every script execution, memory has been tested OK)


BACKTRACE:
---------------------------------------
/install/php-4.3.3/ext/gd/libgd/gd.c(1913) : Block 0x08191CC8 status:
Beginning:      OK (allocated on /install/php-4.3.3/ext/gd/libgd/gd.c:1876, 17 bytes)
      End:      Overflown (magic=0x00000000 instead of 0x2A8FCC84)
                At least 4 bytes overflown
---------------------------------------
/install/php-4.3.3/ext/gd/libgd/gd.c(1876) :  Freeing 0x08191CEC (17 bytes), script=/usr/local/apache/htdocs/vh/www.luckylover
s.net/htdocs/p/pic.php
[Fri Dec 26 15:46:40 2003]  Script:  '/usr/local/apache/htdocs/vh/www.luckylovers.net/htdocs/p/pic.php'
---------------------------------------

GD PROGRAMM:
(line 1876 is 'stack = (struct seg *)emalloc(sizeof(struct seg) * ((int)(im->sy*im->sx)/4)+1);
')

void gdImageFill(gdImagePtr im, int x, int y, int nc)
{
        int l, x1, x2, dy;
        int oc;   /* old pixel value */
        int wx2,wy2;
        /* stack of filled segments */
        //struct seg stack[FILL_MAX],*sp = stack;;
        struct seg *stack;
        struct seg *sp;

        if (nc==gdTiled){
                _gdImageFillTiled(im,x,y,nc);
                return;
        }

        wx2=im->sx;wy2=im->sy;
        oc = gdImageGetPixel(im, x, y);
        if (oc==nc || x<0 || x>wx2 || y<0 || y>wy2) return;

        stack = (struct seg *)emalloc(sizeof(struct seg) * ((int)(im->sy*im->sx)/4)+1);
        sp = stack;

        /* required! */
        FILL_PUSH(y,x,x,1);
        /* seed segment (popped 1st) */
        FILL_PUSH(y+1, x, x, -1);



Reproduce code:
---------------
$height=2;
$width=2;
$im=ImageCreate($width,$height);
$crem=ImageColorAllocate ($im, 229,228,202);
ImageFill($im, 0,0,$crem);
ImageJpeg($im);
ImageDestroy($im);

THANK YOU FOR YOUR HELP !


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-12-26 15:06 UTC] iliaa@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip

Does not appear to crash with latest CVS snapshot. 
 [2004-01-01 20:47 UTC] sniper@php.net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat May 11 10:01:30 2024 UTC