diff options
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/gd/libgd/gd_png.c | 5 | ||||
| -rw-r--r-- | ext/gd/tests/bug45799.phpt | 15 |
2 files changed, 20 insertions, 0 deletions
diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c index 506958106c..6b9c81ec99 100644 --- a/ext/gd/libgd/gd_png.c +++ b/ext/gd/libgd/gd_png.c @@ -543,6 +543,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte ++colors; } } + if (colors == 0) { + php_gd_error("gd-png error: no colors in palette"); + goto bail; + } if (colors < im->colorsTotal) { remap = TRUE; } @@ -740,6 +744,7 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte } } /* 1.6.3: maybe we should give that memory BACK! TBB */ + bail: png_destroy_write_struct(&png_ptr, &info_ptr); } diff --git a/ext/gd/tests/bug45799.phpt b/ext/gd/tests/bug45799.phpt new file mode 100644 index 0000000000..a28f940b76 --- /dev/null +++ b/ext/gd/tests/bug45799.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #45799 (imagepng() crashes on empty image). +--SKIPIF-- +<?php + if (!extension_loaded('gd')) die("skip gd extension not available\n"); +?> +--FILE-- +<?php +$img = imagecreate(500,500); +imagepng($img); +imagedestroy($img); +?> +--EXPECTF-- + +Warning: imagepng(): gd-png error: no colors in palette in %s on line %d |