archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.4'

Browse source
This commit is contained in:
David Carlier 2025-02-14 15:29:32 +00:00
commit 77d748617a
No known key found for this signature in database
GPG key ID: 8486F847B4B94EF1
2 changed files with 33 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
ext/gd/libgd/gd.c
View file

@ -3187,7 +3187,11 @@ int gdImagePaletteToTrueColor(gdImagePtr src)
const unsigned int sy = gdImageSY(src);
const unsigned int sx = gdImageSX(src);
src->tpixels = (int **) gdMalloc(sizeof(int *) * sy);
// Note: do not revert back to gdMalloc() below ; reason here,
// due to a bug with a certain memory_limit INI value treshold,
// imagepalettetotruecolor crashes with even unrelated ZendMM allocations.
// See GH-17772 for an use case.
src->tpixels = (int **) gdCalloc(sizeof(int *), sy);
if (src->tpixels == NULL) {
return 0;
}

28
ext/gd/tests/gh17772.phpt Normal file
View file

@ -0,0 +1,28 @@
--TEST--
GH-17772 (imagepalettetotruecolor segfault on image deallocation)
--EXTENSIONS--
gd
--INI--
memory_limit=2M
--CREDITS--
YuanchengJiang
--SKIPIF--
<?php
if (!GD_BUNDLED) die("skip requires bundled GD library");
?>
--FILE--
<?php
function setStyleAndThickness($im, $color, $thickness)
{
$arr = [];
$i = 0;
while ($i < 16 * $thickness) {
$arer[$i++] = $color;
}
}
$im = imagecreate(800, 800);
setStyleAndThickness($im, 0, 6);
imagepalettetotruecolor($im);
?>
--EXPECTF--
Fatal error: Allowed memory size of %d bytes exhausted%s(tried to allocate %d bytes) in %s on line %d