archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-18 15:08:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix segfault and potential security issue in imagerotate().

Browse source
This commit is contained in:
Scott MacVicar 2008-12-10 13:30:12 +00:00
parent d3ec4e3630
commit 29ab16ee67
2 changed files with 33 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/gd/libgd/gd.c
View file

@ -3129,7 +3129,7 @@ gdImagePtr gdImageRotate (gdImagePtr src, double dAngle, int clrBack, int ignore
return NULL;
}
if (!gdImageTrueColor(src) && clrBack>=gdImageColorsTotal(src)) {
if (!gdImageTrueColor(src) && (clrBack < 0 || clrBack>=gdImageColorsTotal(src))) {
return NULL;
}

32
ext/gd/tests/imagerotate_overflow.phpt Normal file
View file

@ -0,0 +1,32 @@
--TEST--
imagerotate() overflow with negative numbers
--SKIPIF--
<?php
if (!extension_loaded('gd')) {
die("skip gd extension not available.");
}
if (!function_exists('imagerotate')) {
die("skip imagerotate() not available.");
}
?>
--FILE--
<?php
$im = imagecreate(10, 10);
$tmp = imagerotate ($im, 5, -9999999);
var_dump($tmp);
if ($tmp) {
imagedestroy($tmp);
}
if ($im) {
imagedestroy($im);
}
?>
--EXPECT--
bool(false)