MFH Fix segfault and potential security issue in imagerotate().

2 files changed, 33 insertions, 1 deletions

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index d00c697016..a2677c11dd 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -3136,7 +3136,7 @@ gdImagePtr gdImageRotate (gdImagePtr src, double dAngle, int clrBack, int ignore
 		return NULL;
 	}
 
-	if (!gdImageTrueColor(src) && clrBack>=gdImageColorsTotal(src)) {
+	if (!gdImageTrueColor(src) && (clrBack < 0 || clrBack>=gdImageColorsTotal(src))) {
 		return NULL;
 	}
 
diff --git a/ext/gd/tests/imagerotate_overflow.phpt b/ext/gd/tests/imagerotate_overflow.phpt
new file mode 100644
index 0000000000..ade61d8f80
--- /dev/null
+++ b/ext/gd/tests/imagerotate_overflow.phpt
@@ -0,0 +1,32 @@
+--TEST--
+imagerotate() overflow with negative numbers
+--SKIPIF--
+<?php
+	if (!extension_loaded('gd')) {
+		die("skip gd extension not available.");
+	}
+
+	if (!function_exists('imagerotate')) {
+		die("skip imagerotate() not available.");
+	}
+?>
+--FILE--
+<?php
+
+$im = imagecreate(10, 10);
+
+$tmp = imagerotate ($im, 5, -9999999);
+
+var_dump($tmp);
+
+if ($tmp) {
+        imagedestroy($tmp);
+}
+
+if ($im) {
+        imagedestroy($im);
+}
+
+?>
+--EXPECT--
+bool(false)