Bug #66387 [NEW]: Stack overflow with imagefilltoborder

From: fernando at null-life dot com Operating system: Windows PHP version: 5.5.7 Package: GD related Bug Type: Bug Bug description:Stack overflow with imagefilltoborder Description: ------------ There is a stack overflow inside imagefilltoborder. Test script: --------------- $im = imagecreatetruecolor(20, 20); $c = imagecolorallocate($im, 255, 0, 0); imagefilltoborder($im, 0, -999355, $c, $c); Expected result: ---------------- Not crash/image Actual result: -------------- (13cc.e2c): Stack overflow - code c00000fd (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000000 ebx=fff4cb4b ecx=000f4240 edx=00000000 esi=00d9dca0 edi=ffffffff eip=675cca19 esp=003d3000 ebp=003d3004 iopl=0 nv up ei ng nz ac pe cy cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210297 *** WARNING: Unable to verify checksum for C:\php\php_gd2.dll php_gd2!php_gd_gdImageSetPixel+0x9: 675cca19 57 push edi 0:000> k ChildEBP RetAddr 003d3004 675cb829 php_gd2!php_gd_gdImageSetPixel+0x9 [c:\php-sdk\php55\vc11\x86\php-5.5.7\ext\gd\libgd\gd.c @ 723] 003d3034 675cb938 php_gd2!php_gd_gdImageFillToBorder+0x79 [c:\php-sdk\php55\vc11\x86\php-5.5.7\ext\gd\libgd\gd.c @ 1786] 003d3068 675cb938 php_gd2!php_gd_gdImageFillToBorder+0x188 [c:\php-sdk\php55\vc11\x86\php-5.5.7\ext\gd\libgd\gd.c @ 1827] 003d309c 675cb938 php_gd2!php_gd_gdImageFillToBorder+0x188 [c:\php-sdk\php55\vc11\x86\php-5.5.7\ext\gd\libgd\gd.c @ 1827] 003d30d0 675cb938 php_gd2!php_gd_gdImageFillToBorder+0x188 [c:\php-sdk\php55\vc11\x86\php-5.5.7\ext\gd\libgd\gd.c @ 1827] 003d3104 675cb938 php_gd2!php_gd_gdImageFillToBorder+0x188 [c:\php-sdk\php55\vc11\x86\php-5.5.7\ext\gd\libgd\gd.c @ 1827] 003d3138 675cb938 php_gd2!php_gd_gdImageFillToBorder+0x188 [c:\php-sdk\php55\vc11\x86\php-5.5.7\ext\gd\libgd\gd.c @ 1827] 003d316c 675cb938 php_gd2!php_gd_gdImageFillToBorder+0x188 [c:\php-sdk\php55\vc11\x86\php-5.5.7\ext\gd\libgd\gd.c @ 1827] 003d31a0 675cb938 php_gd2!php_gd_gdImageFillToBorder+0x188 [c:\php-sdk\php55\vc11\x86\php-5.5.7\ext\gd\libgd\gd.c @ 1827] ... -- Edit bug report at https://bugs.php.net/bug.php?id=66387&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66387&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66387&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66387&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66387&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66387&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66387&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66387&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66387&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66387&r=support Expected behavior: https://bugs.php.net/fix.php?id=66387&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66387&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66387&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66387&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66387&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66387&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66387&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66387&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66387&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66387&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66387&r=mysqlcfg