diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2016-10-25 13:23:16 +0200 |
|---|---|---|
| committer | Ferenc Kovacs <tyra3l@gmail.com> | 2016-11-09 01:46:37 +0100 |
| commit | 7c27d0329f730d701d18e66db7e85ef7d128712b (patch) | |
| tree | 058da3a55c61e06759e7c124dc0a8772fc631492 | |
| parent | dd8a2cc2455e61c4507b8f419d345da90fa08238 (diff) | |
| download | php-git-7c27d0329f730d701d18e66db7e85ef7d128712b.tar.gz | |
Fix #72696: imagefilltoborder stackoverflow on truecolor images
We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
| -rw-r--r-- | ext/gd/libgd/gd.c | 2 | ||||
| -rw-r--r-- | ext/gd/tests/bug72696.phpt | 14 |
2 files changed, 15 insertions, 1 deletions
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index 058f1c9759..3e7d27a373 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -1747,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color) int leftLimit = -1, rightLimit; int i, restoreAlphaBlending = 0; - if (border < 0) { + if (border < 0 || color < 0) { /* Refuse to fill to a non-solid border */ return; } diff --git a/ext/gd/tests/bug72696.phpt b/ext/gd/tests/bug72696.phpt new file mode 100644 index 0000000000..4f0d9e7f1d --- /dev/null +++ b/ext/gd/tests/bug72696.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #72696 (imagefilltoborder stackoverflow on truecolor images) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$im = imagecreatetruecolor(10, 10); +imagefilltoborder($im, 0, 0, 1, -2); +?> +===DONE=== +--EXPECT-- +===DONE=== |