com php-src: Fixed Bug #66901 php-gd 'c_color' NULL p ointer dereference: ext/gd/libgd/gdxpm.c

Commit: cf4753691dc55999373d1c576f62ecb298723420 Author: Remi Collet <remi@php.net> Mon, 4 Aug 2014 10:42:39 +0200 Parents: ae74549239f80ef40e978942b71c08a7e8a09a23 Branches: PHP-5.4 PHP-5.5 PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=cf4753691dc55999373d1c576f62ecb298723420 Log: Fixed Bug #66901 php-gd 'c_color' NULL pointer dereference Upstream https://bitbucket.org/libgd/gd-libgd/commits/463c3bd09bfe8e924e19acad7a2a6af16953a704 Notice: this fix don't manage monochrome/monovisual values but just fix the security issue CVE-2014-2497 failing when trying to load such an image Bugs: https://bugs.php.net/66901 Changed paths: M ext/gd/libgd/gdxpm.c Diff: diff --git a/ext/gd/libgd/gdxpm.c b/ext/gd/libgd/gdxpm.c index 73f86e5..b69414e 100644 --- a/ext/gd/libgd/gdxpm.c +++ b/ext/gd/libgd/gdxpm.c @@ -31,12 +31,17 @@ gdImagePtr gdImageCreateFromXpm (char *filename) if (ret != XpmSuccess) { return 0; } + number = image.ncolors; + for(i = 0; i < number; i++) { + if (!image.colorTable[i].c_color) { + goto done; + } + } if (!(im = gdImageCreate(image.width, image.height))) { goto done; } - number = image.ncolors; colors = (int *) safe_emalloc(number, sizeof(int), 0); for (i = 0; i < number; i++) { switch (strlen (image.colorTable[i].c_color)) {