Description:
------------
Hello,

GD-version: 5.5.9+dfsg-1ubuntu4.14 (official repo)

We, Stephan Brunner and Tobias Sachs, discovered that the GD library bypasses any memory_limit setting, no matter whether it is forced as an php_admin_value in the fpm pool config or set in the php.ini. Letting gd import an image (131072 by 131072 pixels compressed to 5 MB), download: https://bug.boomer41.net/gd_memory/picture.png) will bypass any memory limit set. 

The memory limit is set to 32MB as a php_admin_value in the pool config of fpm as shown below:
php_admin_value[memory_limit] = 32M

The php.ini file of the fpm remains untouched, 
the memory_limit value of the cli is set to 128M.

Exploitation of this bug renders the machine unusable because the machine starts to swap immediately and uses about 100% of the available cpu and memory resources as shown here: https://bug.boomer41.net/gd_memory/memory_usage.png

Yours sincerely
Stephan Brunner (GPG-Key: ACA501B0@pgp.mit.edu)
Tobias Sachs (GPG-Key: EF14985E@pgp.mit.edu)

Test script:
---------------
<?php

// Also available for download at https://bug.boomer41.net/gd_memory/test.php

// Download link here: https://bug.boomer41.net/gd_memory/picture.png
$picturepath = "picture.png";

imagecreatefromstring(file_get_contents($picturepath));

Expected result:
----------------
The GD library should respect the memory_limit.

Actual result:
--------------
The GD library uses all available resources and renders the machine unusable.