diff options
Diffstat (limited to 'ext/gd/libgd/gd_gd2.c')
| -rw-r--r-- | ext/gd/libgd/gd_gd2.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c index efc6ef47af..6726fee826 100644 --- a/ext/gd/libgd/gd_gd2.c +++ b/ext/gd/libgd/gd_gd2.c @@ -145,9 +145,15 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in cidx = gdCalloc(sidx, 1); for (i = 0; i < nc; i++) { if (gdGetInt(&cidx[i].offset, in) != 1) { + gdFree(cidx); goto fail1; } if (gdGetInt(&cidx[i].size, in) != 1) { + gdFree(cidx); + goto fail1; + } + if (cidx[i].offset < 0 || cidx[i].size < 0) { + gdFree(cidx); goto fail1; } } |