#43121 [Fbk]: gdImageFill with IMG_COLOR_TILED crashes httpd

ID: 43121 Updated by: pajoye@php.net Reported By: carlosp at ravenna dot com Status: Feedback Bug Type: GD related Operating System: FreeBSD 6.2 PHP Version: 5.2.5RC1 -Assigned To: pajoye +Assigned To: mattias New Comment: Assign to Mattias, he will take a look at what I broke since 5.2.3 :) Previous Comments: ------------------------------------------------------------------------ [2007-10-28 22:08:55] pajoye@php.net It is weird, nothing in the imagefill code changed between 5.2.4 and 5.2.5RC. Can you provide a backtrace please? ------------------------------------------------------------------------ [2007-10-28 20:42:10] carlosp at ravenna dot com Description: ------------ Filling an image with a pattern causes httpd segmentation fault. It is reproducible, but it does depend on the image dimensions. Version 5.2.3 works fine, so something changed as of 5.2.4, and still fails in 5.2.5RC1. Reproduce code: --------------- $im = ImageCreate( 200, 100 ); $black = ImageColorAllocate( $im, 0, 0, 0 ); $im_tile = ImageCreateFromGif( "transback.gif" ); ImageSetTile( $im, $im_tile ); ImageFill( $im, 0, 0, IMG_COLOR_TILED ); header( "Content-type: image/gif" ); ImageGif( $im ); ImageDestroy( $im ); Expected result: ---------------- A 200x100 image filled with the specified pattern. BTW, the pattern itself is unremarkable, it fails with several different files I've tried. transback.gif above is a 64x64 from http://www.blueknot.com/CSS/TRANSBACK.gif If you change the image dimensions to 100x100, it will work. 101x100 does not! I've also made it fail using gdImageFilledRectangle and particular rectangle dimensions to fill, but was unable to find a correlation. So the code above is the simplest example of the failure. Actual result: -------------- Safari reports the server suddenly dropped connection. Running httpd -X yields "Segmentation fault" when I execute the above script. Even though I followed the instructions to the letter and tried both httpd -X and through gdb, I am unable to produce a core dump or backtrace...sorry. (The gdb method fails immediately upon startup with "gdb in realloc(): error: pointer to wrong page" but I believe that is unrelated because 5.2.3 also gives me that error when I attempt to run it through gdb), My server is a practically fresh FreeBSD 6.2 install, and I'm using the bundled GD library. This is my configuration command: ./configure --with-mysql --with-mysqli --with- apxs=/usr/local/apache/bin/apxs --with-gd --with-zlib --with-png- dir=/usr/local --with-jpeg-dir=/usr/local --enable-debug ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=43121&edit=1