diff options
author | Remi Collet <remi@php.net> | 2014-03-05 10:40:36 +0100 |
---|---|---|
committer | Julien Pauli <jpauli@php.net> | 2014-03-05 10:53:57 +0100 |
commit | 0880851f004ba8ad793b9fb68e3ee6755245a0ba (patch) | |
tree | 381d131ca2bdb7be0b755504dcbbe46c0d41cb17 /main/php_variables.h | |
parent | 53c6b594f5a0dc1650acfef37d6282d15fea593f (diff) | |
download | php-git-0880851f004ba8ad793b9fb68e3ee6755245a0ba.tar.gz |
Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327
This amends commit 8f4a537, which aimed to correct NULL dereference because of
missing check of gdImageCreateTrueColor() / gdImageCreate() return value. That
commit checks for negative crop rectangle width and height, but
gdImageCreate*() can also return NULL when width * height overflows. Hence
NULL deref is still possible, as gdImageSaveAlpha() and gdImagePaletteCopy()
is called before dst == NULL check.
This moves NULL check to happen right after gdImageCreate*(). It also removes
width and height check before gdImageCreate*(), as the same check is done by
image create functions (with an extra warning).
From thoger redhat com
Diffstat (limited to 'main/php_variables.h')
0 files changed, 0 insertions, 0 deletions