diff options
| -rw-r--r-- | ext/gd/libgd/gd.c | 4 | ||||
| -rw-r--r-- | ext/gd/tests/bug66387.phpt | 15 |
2 files changed, 19 insertions, 0 deletions
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index d73f0943af..2c63aac4cd 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -1774,9 +1774,13 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color) if (x >= im->sx) { x = im->sx - 1; + } else if (x < 0) { + x = 0; } if (y >= im->sy) { y = im->sy - 1; + } else if (y < 0) { + y = 0; } for (i = x; i >= 0; i--) { diff --git a/ext/gd/tests/bug66387.phpt b/ext/gd/tests/bug66387.phpt new file mode 100644 index 0000000000..79c49a527b --- /dev/null +++ b/ext/gd/tests/bug66387.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #66387 (Stack overflow with imagefilltoborder) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available!'); +?> +--FILE-- +<?php +$im = imagecreatetruecolor(20, 20); +$c = imagecolorallocate($im, 255, 0, 0); +imagefilltoborder($im, 0, -999355, $c, $c); +echo "ready\n"; +?> +--EXPECT-- +ready |