#19366 [NEW]: buggy GD scripts crashes PHP

From: honza@honza.info Operating system: linux mandrake 2.4.19-7mdk PHP version: 4.2.3 PHP Bug Type: Reproducible crash Bug description: buggy GD scripts crashes PHP Hello, well, this will be more tricky, as it doesn't happen on my local computer (win32), but the web-hosting server I use (and pay). I exchanged several e-mails with the administrator of the web-hosting service (www.pipni.cz) and it crashes: mandrake 2.4.19-7mdk + PHP 4.2.3 completely, including apache same on redhat on slackware 8.1 + php 4.2.2 only the script crashed, not whole server. Now to the script. I got this script from a Czech PHP course and there was a bug in the script. It creates a bitmap and then draws into the bitmap. The bug is the bitmap is too small, the coordinates used in draw and fill functions are beyond the size of the bitmap. And the fill functions that get the starting point outside of bitmap let it go down. Here is the script: <?php $width = 50; $height = 100; $ImHandle = imagecreate($width,$height); //Define colors $MyBlue = imagecolorAllocate($ImHandle, 0, 0, 255); $MyRed = imagecolorAllocate($ImHandle, 255, 0, 0); $MyWhite = imagecolorAllocate($ImHandle, 255, 255, 255); $MyBlack = imagecolorAllocate($ImHandle, 0, 0, 0); //Draw ImageFill($ImHandle,0,0,$MyBlack); ImageLine($ImHandle,20,20,180,20,$MyWhite); ImageLine($ImHandle,20,20,20,70,$MyBlue); ImageLine($ImHandle,20,70,180,70,$MyRed); ImageLine($ImHandle,180,20,180,45,$MyWhite); ImageLine($ImHandle,180,70,180,45,$MyRed); ImageLine($ImHandle,20,20,100,45,$MyBlue); ImageLine($ImHandle,20,70,100,45,$MyBlue); ImageLine($ImHandle,100,45,180,45,$MyRed); ImageFill($ImHandle,21,45,$MyBlue); ImageFill($ImHandle,100,69,$MyRed); ImageFill($ImHandle,100,21,$MyWhite); ImageString($ImHandle,4,40,75,"Czech Republic",$MyWhite); // Send to browser Header("Content-type: image/PNG"); ImagePNG($ImHandle); //Free resources imagedestroy($ImHandle); ?> Take care Honza -- Edit bug report at http://bugs.php.net/?id=19366&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=19366&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=19366&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=19366&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=19366&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=19366&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=19366&r=support Expected behavior: http://bugs.php.net/fix.php?id=19366&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=19366&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=19366&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=19366&r=globals