Bug #72045 [NEW]: Stack-overflow on imagefilltoborder

From: fernando at null-life dot com Operating system: Linux PHP version: 5.6.20 Package: GD related Bug Type: Bug Bug description:Stack-overflow on imagefilltoborder Description: ------------ Run test script with PHP 5.6.20. Test script: --------------- <?php $img = imagecreatetruecolor (100 , 100); imagefilltoborder($img, 100, 1, 257, -10066304); Expected result: ---------------- No crash Actual result: -------------- ERROR: AddressSanitizer: stack-overflow on address 0xbf142ff8 (pc 0xb299e348 bp 0x00000064 sp 0xbf142ffc T0) #0 0xb299e347 in gdImageFillToBorder (/usr/lib/i386-linux-gnu/libgd.so.3+0xb347) #1 0xb299e507 in gdImageFillToBorder (/usr/lib/i386-linux-gnu/libgd.so.3+0xb507) #2 0xb299e4e7 in gdImageFillToBorder (/usr/lib/i386-linux-gnu/libgd.so.3+0xb4e7) ... #248 0xb299e4e7 in gdImageFillToBorder (/usr/lib/i386-linux-gnu/libgd.so.3+0xb4e7) #249 0xb299e507 in gdImageFillToBorder (/usr/lib/i386-linux-gnu/libgd.so.3+0xb507) #250 0xb299e4e7 in gdImageFillToBorder (/usr/lib/i386-linux-gnu/libgd.so.3+0xb4e7) SUMMARY: AddressSanitizer: stack-overflow ??:0 gdImageFillToBorder ==8427==ABORTING -- Edit bug report at https://bugs.php.net/bug.php?id=72045&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72045&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72045&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72045&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72045&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72045&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72045&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72045&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72045&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72045&r=support Expected behavior: https://bugs.php.net/fix.php?id=72045&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72045&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72045&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72045&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72045&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72045&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72045&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72045&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72045&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72045&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72045&r=mysqlcfg