summaryrefslogtreecommitdiff
path: root/ext/sqlite3/libsqlite/php-sqlite3-changes.patch
diff options
context:
space:
mode:
authorRemi Collet <remi@php.net>2014-03-05 10:40:36 +0100
committerRemi Collet <remi@php.net>2014-03-05 10:40:36 +0100
commitaf09d8b96a8aacdd7d738fec81b695c1c58368f7 (patch)
tree8ebbd84fce5d45b214ead7c93ea2a8ad8742f8a7 /ext/sqlite3/libsqlite/php-sqlite3-changes.patch
parent014b95a0a7b638787aaa3d6ed864b6c3eaed3910 (diff)
downloadphp-git-af09d8b96a8aacdd7d738fec81b695c1c58368f7.tar.gz
Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327
This amends commit 8f4a537, which aimed to correct NULL dereference because of missing check of gdImageCreateTrueColor() / gdImageCreate() return value. That commit checks for negative crop rectangle width and height, but gdImageCreate*() can also return NULL when width * height overflows. Hence NULL deref is still possible, as gdImageSaveAlpha() and gdImagePaletteCopy() is called before dst == NULL check. This moves NULL check to happen right after gdImageCreate*(). It also removes width and height check before gdImageCreate*(), as the same check is done by image create functions (with an extra warning). From thoger redhat com
Diffstat (limited to 'ext/sqlite3/libsqlite/php-sqlite3-changes.patch')
0 files changed, 0 insertions, 0 deletions