diff options
author | Remi Collet <remi@php.net> | 2014-03-05 10:40:36 +0100 |
---|---|---|
committer | Remi Collet <remi@php.net> | 2014-03-05 10:40:36 +0100 |
commit | af09d8b96a8aacdd7d738fec81b695c1c58368f7 (patch) | |
tree | 8ebbd84fce5d45b214ead7c93ea2a8ad8742f8a7 /ext/sqlite3/libsqlite/php-sqlite3-changes.patch | |
parent | 014b95a0a7b638787aaa3d6ed864b6c3eaed3910 (diff) | |
download | php-git-af09d8b96a8aacdd7d738fec81b695c1c58368f7.tar.gz |
Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327
This amends commit 8f4a537, which aimed to correct NULL dereference because of
missing check of gdImageCreateTrueColor() / gdImageCreate() return value. That
commit checks for negative crop rectangle width and height, but
gdImageCreate*() can also return NULL when width * height overflows. Hence
NULL deref is still possible, as gdImageSaveAlpha() and gdImagePaletteCopy()
is called before dst == NULL check.
This moves NULL check to happen right after gdImageCreate*(). It also removes
width and height check before gdImageCreate*(), as the same check is done by
image create functions (with an extra warning).
From thoger redhat com
Diffstat (limited to 'ext/sqlite3/libsqlite/php-sqlite3-changes.patch')
0 files changed, 0 insertions, 0 deletions