summaryrefslogtreecommitdiff
path: root/main/php_variables.h
diff options
context:
space:
mode:
authorRemi Collet <remi@php.net>2014-03-05 10:40:36 +0100
committerJulien Pauli <jpauli@php.net>2014-03-05 10:53:57 +0100
commit0880851f004ba8ad793b9fb68e3ee6755245a0ba (patch)
tree381d131ca2bdb7be0b755504dcbbe46c0d41cb17 /main/php_variables.h
parent53c6b594f5a0dc1650acfef37d6282d15fea593f (diff)
downloadphp-git-0880851f004ba8ad793b9fb68e3ee6755245a0ba.tar.gz
Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327
This amends commit 8f4a537, which aimed to correct NULL dereference because of missing check of gdImageCreateTrueColor() / gdImageCreate() return value. That commit checks for negative crop rectangle width and height, but gdImageCreate*() can also return NULL when width * height overflows. Hence NULL deref is still possible, as gdImageSaveAlpha() and gdImagePaletteCopy() is called before dst == NULL check. This moves NULL check to happen right after gdImageCreate*(). It also removes width and height check before gdImageCreate*(), as the same check is done by image create functions (with an extra warning). From thoger redhat com
Diffstat (limited to 'main/php_variables.h')
0 files changed, 0 insertions, 0 deletions