diff options
| author | Stanislav Malyshev <stas@php.net> | 2019-05-27 16:49:31 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2019-05-27 16:49:31 -0700 |
| commit | 5e3dc08826ae7f105249e4b30fdf2211ec989b79 (patch) | |
| tree | 3e1be8832141de90774752113613a1b93918a72f /ext/gd/libgd | |
| parent | c12d474653c6d10cd74391943bdb7af4509ed2d3 (diff) | |
| parent | c7eb0feed8651b0c3f851e7701fd8fe471c4c717 (diff) | |
| download | php-git-5e3dc08826ae7f105249e4b30fdf2211ec989b79.tar.gz | |
Merge branch 'PHP-7.3' into PHP-7.4
* PHP-7.3:
Update NEWS
Fix bug #78069 - Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow
Fix #77973: Uninitialized read in gdImageCreateFromXbm
Diffstat (limited to 'ext/gd/libgd')
| -rw-r--r-- | ext/gd/libgd/gd_xbm.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ext/gd/libgd/gd_xbm.c b/ext/gd/libgd/gd_xbm.c index a37d833d3b..70d9b41057 100644 --- a/ext/gd/libgd/gd_xbm.c +++ b/ext/gd/libgd/gd_xbm.c @@ -136,7 +136,11 @@ gdImagePtr gdImageCreateFromXbm(FILE * fd) } h[3] = ch; } - sscanf(h, "%x", &b); + if (sscanf(h, "%x", &b) != 1) { + php_gd_error("invalid XBM"); + gdImageDestroy(im); + return 0; + } for (bit = 1; bit <= max_bit; bit = bit << 1) { gdImageSetPixel(im, x++, y, (b & bit) ? 1 : 0); if (x == im->sx) { |