Patch libgd-v2.patch for GD related Bug #66356

Patch version 2013-12-28 08:13 UTC

• 2013-12-28 08:13 UTC [diff to current]

Developer: remi@php.net

diff -up ../ext/gd/libgd/gd_crop.c.old ../ext/gd/libgd/gd_crop.c
--- ../ext/gd/libgd/gd_crop.c.old	2013-12-28 08:43:50.090862436 +0100
+++ ../ext/gd/libgd/gd_crop.c	2013-12-28 09:10:39.420873991 +0100
@@ -44,6 +44,12 @@ gdImagePtr gdImageCrop(gdImagePtr src, c
 {
 	gdImagePtr dst;
 
+	/* check size */
+	if (crop->width<0 || crop->height<0) {
+		return NULL;
+	}
+
+	/* allocate the requested size (could be only partially filled) */
 	if (src->trueColor) {
 		dst = gdImageCreateTrueColor(crop->width, crop->height);
 		gdImageSaveAlpha(dst, 1);
@@ -53,12 +59,20 @@ gdImagePtr gdImageCrop(gdImagePtr src, c
 	}
 	dst->transparent = src->transparent;
 
-	if (src->sx < (crop->x + crop->width -1)) {
-		crop->width = src->sx - crop->x + 1;
+	/* check position in the src image */
+	if (crop->x < 0 || crop->x>=src->sx
+		|| crop->y<0 || crop->y>=src->sy) {
+		return dst;
 	}
-	if (src->sy < (crop->y + crop->height -1)) {
-		crop->height = src->sy - crop->y + 1;
+
+	/* reduce size if needed */
+	if ((src->sx - crop->width) < crop->x) {
+		crop->width = src->sx - crop->x;
 	}
+	if ((src->sy - crop->height) < crop->y) {
+		crop->height = src->sy - crop->y;
+	}
+
 #if 0
 printf("rect->x: %i\nrect->y: %i\nrect->width: %i\nrect->height: %i\n", crop->x, crop->y, crop->width, crop->height);
 #endif