cvs: php4(PHP_4_3) / TODO_SEGFAULTS

moriyoshi Fri Apr 4 04:15:18 2003 EDT Modified files: (Branch: PHP_4_3) /php4 TODO_SEGFAULTS Log: Sorry, forgot these ones Index: php4/TODO_SEGFAULTS diff -u php4/TODO_SEGFAULTS:1.1.2.27 php4/TODO_SEGFAULTS:1.1.2.28 --- php4/TODO_SEGFAULTS:1.1.2.27 Fri Apr 4 04:13:28 2003 +++ php4/TODO_SEGFAULTS Fri Apr 4 04:15:18 2003 @@ -71,15 +71,15 @@ echo dbase_open | php do_crash.txt -(5) integer overflow inside php_imagepolygon and possible subsequent +(4) integer overflow inside php_imagepolygon and possible subsequent integer overflows inside gdlib's gdImageFilledPolygon(). -(6) integer overflow if the number of elements in the array passed as +(5) integer overflow if the number of elements in the array passed as second argument * sizeof(int) result in an overflow. gdImageSetStyle function called by this php wrapper can die for the same reason. -(7) multiple integer overflows that can occur when trying to allocate a buffer +(6) multiple integer overflows that can occur when trying to allocate a buffer for a new image. Affected functions: gdImageCreateFromJpegCtx readwbmp