diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2018-12-30 13:59:26 +0100 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-01-06 11:38:46 -0800 |
| commit | 567c9f58425c37260864f276b6d3f434eecf4b49 (patch) | |
| tree | 68c2ac6fc008f59a7f0ec3f9ec0d3754b5732569 | |
| parent | 4feb9e66ff9636ad44bc23a91b7ebd37d83ddf1d (diff) | |
| download | php-git-567c9f58425c37260864f276b6d3f434eecf4b49.tar.gz | |
Fix #77270: imagecolormatch Out Of Bounds Write on Heap
At least some of the image reading functions may return images which
use color indexes greater than or equal to im->colorsTotal. We cater
to this by always using a buffer size which is sufficient for
`gdMaxColors` in `gdImageColorMatch()`.
| -rw-r--r-- | ext/gd/libgd/gd_color.c | 4 | ||||
| -rw-r--r-- | ext/gd/tests/bug77270.phpt | 18 |
2 files changed, 20 insertions, 2 deletions
diff --git a/ext/gd/libgd/gd_color.c b/ext/gd/libgd/gd_color.c index a4e56b1c40..e6f539bc75 100644 --- a/ext/gd/libgd/gd_color.c +++ b/ext/gd/libgd/gd_color.c @@ -33,8 +33,8 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2) return -4; /* At least 1 color must be allocated */ } - buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0); - memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal ); + buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * gdMaxColors, 0); + memset( buf, 0, sizeof(unsigned long) * 5 * gdMaxColors ); for (x=0; x<im1->sx; x++) { for( y=0; y<im1->sy; y++ ) { diff --git a/ext/gd/tests/bug77270.phpt b/ext/gd/tests/bug77270.phpt new file mode 100644 index 0000000000..1c4555a64d --- /dev/null +++ b/ext/gd/tests/bug77270.phpt @@ -0,0 +1,18 @@ +--TEST-- +Bug #77270 (imagecolormatch Out Of Bounds Write on Heap) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream bugfix has not been released'); +?> +--FILE-- +<?php +$img1 = imagecreatetruecolor(0xfff, 0xfff); +$img2 = imagecreate(0xfff, 0xfff); +imagecolorallocate($img2, 0, 0, 0); +imagesetpixel($img2, 0, 0, 255); +imagecolormatch($img1, $img2); +?> +===DONE=== +--EXPECT-- +===DONE=== |