From dfd8237aec01116b32447881aa6008a90d45cb4c Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Wed, 12 Dec 2018 16:00:59 +0100 Subject: Fix #77269: Potential unsigned underflow in gdImageScale Belatedly, we're porting the respective upstream patch[1]. [1] --- ext/gd/libgd/gd_interpolation.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'ext/gd/libgd') diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c index 2a2479c912..e3cd741f8a 100644 --- a/ext/gd/libgd/gd_interpolation.c +++ b/ext/gd/libgd/gd_interpolation.c @@ -890,8 +890,13 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length, { unsigned int u = 0; LineContribType *res; - int overflow_error = 0; + size_t weights_size; + if (overflow2(windows_size, sizeof(double))) { + return NULL; + } else { + weights_size = windows_size * sizeof(double); + } res = (LineContribType *) gdMalloc(sizeof(LineContribType)); if (!res) { return NULL; @@ -908,15 +913,10 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length, return NULL; } for (u = 0 ; u < line_length ; u++) { - if (overflow2(windows_size, sizeof(double))) { - overflow_error = 1; - } else { - res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double)); - } - if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) { + res->ContribRow[u].Weights = (double *) gdMalloc(weights_size); + if (res->ContribRow[u].Weights == NULL) { unsigned int i; - u--; - for (i=0;i<=u;i++) { + for (i=0;iContribRow[i].Weights); } gdFree(res->ContribRow); -- cgit v1.2.1 From 567c9f58425c37260864f276b6d3f434eecf4b49 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Sun, 30 Dec 2018 13:59:26 +0100 Subject: Fix #77270: imagecolormatch Out Of Bounds Write on Heap At least some of the image reading functions may return images which use color indexes greater than or equal to im->colorsTotal. We cater to this by always using a buffer size which is sufficient for `gdMaxColors` in `gdImageColorMatch()`. --- ext/gd/libgd/gd_color.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'ext/gd/libgd') diff --git a/ext/gd/libgd/gd_color.c b/ext/gd/libgd/gd_color.c index a4e56b1c40..e6f539bc75 100644 --- a/ext/gd/libgd/gd_color.c +++ b/ext/gd/libgd/gd_color.c @@ -33,8 +33,8 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2) return -4; /* At least 1 color must be allocated */ } - buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0); - memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal ); + buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * gdMaxColors, 0); + memset( buf, 0, sizeof(unsigned long) * 5 * gdMaxColors ); for (x=0; xsx; x++) { for( y=0; ysy; y++ ) { -- cgit v1.2.1