diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2016-09-19 16:49:06 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2016-09-19 16:56:07 +0200 |
| commit | 77ba2483d95ec12a8ec4c12ccd0453827f8d3fb8 (patch) | |
| tree | 8507ff83cfa9ddd050e4a2741692d1f43c7e9735 | |
| parent | 6f7479251bb4e5466fc77e8e8ad01d3c1d85f02e (diff) | |
| download | php-git-77ba2483d95ec12a8ec4c12ccd0453827f8d3fb8.tar.gz | |
Port gdImageSetStyle() overflow check from libgd 2.0.29
| -rw-r--r-- | ext/gd/libgd/gd.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index 57c0aeafb1..7a0af8de92 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -2789,6 +2789,9 @@ void gdImageSetStyle (gdImagePtr im, int *style, int noOfPixels) if (im->style) { gdFree(im->style); } + if (overflow2(sizeof (int), noOfPixels)) { + return; + } im->style = (int *) gdMalloc(sizeof(int) * noOfPixels); memcpy(im->style, style, sizeof(int) * noOfPixels); im->styleLength = noOfPixels; |