diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2004-05-09 18:25:33 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2004-05-09 18:25:33 +0000 |
| commit | f11d064b6a2b811de9bb8291b605944ee365d5bf (patch) | |
| tree | 455b8932749aa8f0e67005c6536ede9ff5ec9e89 /ext | |
| parent | 9557b4013a071176d2185211f378e726dffcd4ac (diff) | |
| download | php-git-f11d064b6a2b811de9bb8291b605944ee365d5bf.tar.gz | |
Fixed bug #28304 (Missing bounds check inside imagefilter()).
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/gd/libgd/gd.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index ff3e60a7d4..c3f3be822d 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -3607,8 +3607,9 @@ int gdImageConvolution(gdImagePtr src, float filter[3][3], float filter_div, flo new_a = gdImageAlpha(srcback, pxl); for (j=0; j<3; j++) { + int yv = MIN(MAX(y - 1 + j, 0), src->sy - 1); for (i=0; i<3; i++) { - pxl = f(srcback, x-(3>>1)+i, y-(3>>1)+j); + pxl = f(srcback, MIN(MAX(x - 1 + i, 0), src->sx - 1), yv); new_r += (float)gdImageRed(srcback, pxl) * filter[j][i]; new_g += (float)gdImageGreen(srcback, pxl) * filter[j][i]; new_b += (float)gdImageBlue(srcback, pxl) * filter[j][i]; |