php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Return to Bug #72696
Patch fix-72696 revision 2016-10-25 11:26 UTC by cmb@php.net

Patch fix-72696 for GD related Bug #72696

Patch version 2016-10-25 11:26 UTC

Return to Bug #72696 | Download this patch
Patch Revisions:

Developer: cmb@php.net

From 0bf12efc449ddda9426ff86178d533ec2e6ab665 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Tue, 25 Oct 2016 13:23:16 +0200
Subject: [PATCH] Fix #72696: imagefilltoborder stackoverflow on truecolor
 images

We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
---
 ext/gd/libgd/gd.c          |  2 +-
 ext/gd/tests/bug72696.phpt | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 ext/gd/tests/bug72696.phpt

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 033d4fa..c15a0c3 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1792,7 +1792,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 	int leftLimit = -1, rightLimit;
 	int i, restoreAlphaBlending = 0;
 
-	if (border < 0) {
+	if (border < 0 || color < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}
diff --git a/ext/gd/tests/bug72696.phpt b/ext/gd/tests/bug72696.phpt
new file mode 100644
index 0000000..6afaa37
--- /dev/null
+++ b/ext/gd/tests/bug72696.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilltoborder($im, 0, 0, 1, -2);
+?>
+===DONE===
+--EXPECT--
+===DONE===
-- 
2.8.1.windows.1

 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Tue Mar 28 00:01:34 2017 UTC