diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-08-10 00:14:58 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-08-16 22:55:40 -0700 |
| commit | 1bd103df00f49cf4d4ade2cfe3f456ac058a4eae (patch) | |
| tree | c8b65f7721f11f7e808edcc7235079ba22c6490b | |
| parent | a3598dd7c9b182debcb54b9322b1dece14c9b533 (diff) | |
| download | php-git-1bd103df00f49cf4d4ade2cfe3f456ac058a4eae.tar.gz | |
Fix bug #72730 - imagegammacorrect allows arbitrary write access
| -rw-r--r-- | ext/gd/gd.c | 5 | ||||
| -rw-r--r-- | ext/gd/tests/bug72730.phpt | 15 |
2 files changed, 20 insertions, 0 deletions
diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 5c604b7a80..0fb9604108 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -3082,6 +3082,11 @@ PHP_FUNCTION(imagegammacorrect) return; } + if ( input <= 0.0 || output <= 0.0 ) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive"); + RETURN_FALSE; + } + ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd); if (gdImageTrueColor(im)) { diff --git a/ext/gd/tests/bug72730.phpt b/ext/gd/tests/bug72730.phpt new file mode 100644 index 0000000000..e7c13cb5e9 --- /dev/null +++ b/ext/gd/tests/bug72730.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #72730: imagegammacorrect allows arbitrary write access +--SKIPIF-- +<?php +if (!function_exists("imagecreatetruecolor")) die("skip"); +?> +--FILE-- +<?php +$img = imagecreatetruecolor(1, 1); +imagegammacorrect($img, -1, 1337); +?> +DONE +--EXPECTF-- +Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d +DONE
\ No newline at end of file |