Description:
------------
In gdImageFill, a stack is created for the flood fill algorithm. Originally it seems the stack was created with space for 1,200,000 structures, but that has since been commented out and the stack is now created dynamically with the depth determined by the size of the image. The macro used to push structures onto the stack was checking for overflow based on checking the current stack pointer. Instead of comparing the stack pointer to the real size of the stack, the stack pointer was compared against the size of the structure (16 bytes) * 1,200,000 * 10. I have no idea why the factor of 10 was there. This large value wraps 32-bit arithmetic all the way around such that the comparison was no longer valid, and it always seemed the stack had overflowed even before anything was pushed onto it.

Reproduce code:
---------------
<?php
        $im = imagecreatetruecolor(30, 50);
        imagefill($im, 0, 0, 1); // Color every pixel 1
        $col = imagecolorat($im, 20, 20);
        echo "$col\n";
?>

Expected result:
----------------
1

Actual result:
--------------
0 when the bug shows up. I found it to fail on ppc64 when it was built as a ppc32 userspace library, while on a ppc32 or x86 or x86_64 system it passed just fine.