diff options
| author | Pierre Joye <pajoye@php.net> | 2006-07-26 08:53:30 +0000 |
|---|---|---|
| committer | Pierre Joye <pajoye@php.net> | 2006-07-26 08:53:30 +0000 |
| commit | 206ec1a06b8c65ebfc48306ff69a99b92a32a062 (patch) | |
| tree | 11d1b0f5a578f51e10cc1d5b43198c2cb7b61af9 | |
| parent | 3688c103b5cbc23274cfd905f01163f4b00b9583 (diff) | |
| download | php-git-206ec1a06b8c65ebfc48306ff69a99b92a32a062.tar.gz | |
- MFH #38212, Segfault on invalid imagecreatefromgd2part() parameters
| -rw-r--r-- | ext/gd/libgd/gd_gd2.c | 4 | ||||
| -rw-r--r-- | ext/gd/tests/bug38212.phpt | 17 |
2 files changed, 21 insertions, 0 deletions
diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c index 1e739179e2..3f24e4a476 100644 --- a/ext/gd/libgd/gd_gd2.c +++ b/ext/gd/libgd/gd_gd2.c @@ -430,6 +430,10 @@ gdImagePtr gdImageCreateFromGd2PartCtx (gdIOCtx * in, int srcx, int srcy, int w, gdImagePtr im; + if (w<1 || h <1) { + return 0; + } + /* The next few lines are basically copied from gd2CreateFromFile * we change the file size, so don't want to use the code directly. * but we do need to know the file size. diff --git a/ext/gd/tests/bug38212.phpt b/ext/gd/tests/bug38212.phpt new file mode 100644 index 0000000000..0094712a55 --- /dev/null +++ b/ext/gd/tests/bug38212.phpt @@ -0,0 +1,17 @@ +--TEST-- +imagecopy doen't copy alpha, palette to truecolor +--SKIPIF-- +<?php + if (!function_exists('imagecopy')) die("skip gd extension not available\n"); +?> +--FILE-- +<?php +$file = dirname(__FILE__) . '/bug38212.gd2'; +$im1 = imagecreatetruecolor(10,100); +imagefill($im1, 0,0, 0xffffff); +imagegd2($im1, $file); +$im = imagecreatefromgd2part($file, 0,0, -25,10); +unlink($file); +?> +--EXPECTF-- +Warning: imagecreatefromgd2part(): '%sbug38212.gd2' is not a valid GD2 file in %sbug38212.php on line %d |