diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-12-07 23:30:49 -0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2015-12-07 23:33:05 -0800 |
| commit | 4bb422343f29f06b7081323844d9b52e1a71e4a5 (patch) | |
| tree | ac375504b469afc8cbb7642f4b6eaec63294f973 | |
| parent | 2e157c527508c3cfa85bdabffe0560f2e50abf18 (diff) | |
| download | php-git-4bb422343f29f06b7081323844d9b52e1a71e4a5.tar.gz | |
Fix bug #70976: fix boundary check on gdImageRotateInterpolated
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/gd/libgd/gd_interpolation.c | 2 | ||||
| -rw-r--r-- | ext/gd/tests/bug70976.phpt | 13 |
3 files changed, 18 insertions, 1 deletions
@@ -4,6 +4,10 @@ PHP NEWS ?? ??? 2015, PHP 5.5.31 +- GD: + . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index + Out of Bounds). (emmanuel dot law at gmail dot com). + 01 Oct 2015, PHP 5.5.30 - Phar: diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c index 65e2360776..efb584c1e4 100644 --- a/ext/gd/libgd/gd_interpolation.c +++ b/ext/gd/libgd/gd_interpolation.c @@ -2154,7 +2154,7 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in { const int angle_rounded = (int)floor(angle * 100); - if (bgcolor < 0) { + if (bgcolor < 0 || bgcolor >= gdMaxColors) { return NULL; } diff --git a/ext/gd/tests/bug70976.phpt b/ext/gd/tests/bug70976.phpt new file mode 100644 index 0000000000..23af4eedc7 --- /dev/null +++ b/ext/gd/tests/bug70976.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds) +--SKIPIF-- +<?php + if(!extension_loaded('gd')){ die('skip gd extension not available'); } +?> +--FILE-- +<?php +$img = imagerotate(imagecreate(1,1),45,0x7ffffff9); +var_dump($img); +?> +--EXPECTF-- +bool(false)
\ No newline at end of file |