Description:
------------
Hi,

In /ext/gd/libgd/gd_io_dp.c:

if this goes to the false branch:

333        if ((newPtr = gdRealloc(dp->data, required))) {
334                dp->realSize = required;
335                dp->data = newPtr;
336                return TRUE;
337        }

the fact there is code after this, makes me think it is possible for this to happen:

'dp->data' will be freed but not re-allocated.

It is then used here:
343        memcpy(newPtr, dp->data, dp->logicalSize);

which will cause a use-after-free bug.



Thanks,