diff options
| author | Pierre Joye <pajoye@php.net> | 2009-10-12 10:01:37 +0000 |
|---|---|---|
| committer | Pierre Joye <pajoye@php.net> | 2009-10-12 10:01:37 +0000 |
| commit | ed3e96197ded1fea0db5c09bfc6290a833af35c8 (patch) | |
| tree | 0647222b994600525bf4c002da7cd79eae9a166a | |
| parent | 1835a63dfddcf1a82d677ee2cf1db2d8a34d1a7f (diff) | |
| download | php-git-ed3e96197ded1fea0db5c09bfc6290a833af35c8.tar.gz | |
- check max colors while loading gd2 palette image (patch by Tomas Hoger)
| -rw-r--r-- | ext/gd/libgd/gd_gd.c | 3 | ||||
| -rw-r--r-- | ext/gd/tests/crafted.gd2 | bin | 0 -> 1039 bytes | |||
| -rw-r--r-- | ext/gd/tests/crafted_gd2.phpt | 16 |
3 files changed, 19 insertions, 0 deletions
diff --git a/ext/gd/libgd/gd_gd.c b/ext/gd/libgd/gd_gd.c index 55587d43e8..81a957d414 100644 --- a/ext/gd/libgd/gd_gd.c +++ b/ext/gd/libgd/gd_gd.c @@ -39,6 +39,9 @@ int _gdGetColors (gdIOCtx * in, gdImagePtr im, int gd2xFlag) if (!gdGetWord(&im->colorsTotal, in)) { goto fail1; } + if (im->colorsTotal > gdMaxColors) { + goto fail1; + } } /* Int to accommodate truecolor single-color transparency */ if (!gdGetInt(&im->transparent, in)) { diff --git a/ext/gd/tests/crafted.gd2 b/ext/gd/tests/crafted.gd2 Binary files differnew file mode 100644 index 0000000000..45c944cc29 --- /dev/null +++ b/ext/gd/tests/crafted.gd2 diff --git a/ext/gd/tests/crafted_gd2.phpt b/ext/gd/tests/crafted_gd2.phpt new file mode 100644 index 0000000000..7bcbc4e68b --- /dev/null +++ b/ext/gd/tests/crafted_gd2.phpt @@ -0,0 +1,16 @@ +--TEST-- +Test max colors for a gd image. +--SKIPIF-- +<?php + if (!extension_loaded('gd')) { + die("skip gd extension not available\n"); + } +?> +--FILE-- +<?php +imagecreatefromgd(dirname(__FILE__) . '/crafted.gd2'); +?> +--EXPECTF-- + +Warning: imagecreatefromgd(): '%scrafted.gd2' is not a valid GD file in %s on line %d + |