Skip to content

Instantly share code, notes, and snippets.

/72696.diff Secret
Created Oct 30, 2016

Embed
What would you like to do?
Patch for 72696
commit 863d37ea66d5c960db08d6f4a2cbd2518f0f80d1
Author: Christoph M. Becker <cmbecker69@gmx.de>
Date: Tue Oct 25 13:23:16 2016 +0200
Fix #72696: imagefilltoborder stackoverflow on truecolor images
We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 058f1c9..3e7d27a 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1747,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
int leftLimit = -1, rightLimit;
int i, restoreAlphaBlending = 0;
- if (border < 0) {
+ if (border < 0 || color < 0) {
/* Refuse to fill to a non-solid border */
return;
}
diff --git a/ext/gd/tests/bug72696.phpt b/ext/gd/tests/bug72696.phpt
new file mode 100644
index 0000000..4f0d9e7
--- /dev/null
+++ b/ext/gd/tests/bug72696.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilltoborder($im, 0, 0, 1, -2);
+?>
+===DONE===
+--EXPECT--
+===DONE===
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.