com php-src: fix #72512, invalid read or write for palette image when invalid transparent index is used: ext/gd/libgd/gd.c
ext/gd/libgd/gd_interpolation.c ext/gd/tests/bug725 12.phpt

Commit: 928aecc002e906b309b28f0062f03d4e5eda3e45 Author: Pierre Joye <pierre.php@gmail.com> Tue, 19 Jul 2016 13:37:23 +0700 Committer: Stanislav Malyshev <stas@php.net> Tue, 19 Jul 2016 00:37:38 -0700 Parents: 33c1a55b40900c61ce7e162648eb71ce9b25837c Branches: PHP-5.5 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=928aecc002e906b309b28f0062f03d4e5eda3e45 Log: fix #72512, invalid read or write for palette image when invalid transparent index is used Conflicts: ext/gd/libgd/gd.c Bugs: https://bugs.php.net/72512 Changed paths: M ext/gd/libgd/gd.c M ext/gd/libgd/gd_interpolation.c A ext/gd/tests/bug72512.phpt Diff: diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index c501c67..9fce60b 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -602,11 +602,11 @@ void gdImageColorTransparent (gdImagePtr im, int color) if (color < 0) { return; } - if (!im->trueColor) { - if((color >= gdMaxColors)) { + if((color >= im->colorsTotal)) { return; } + /* Make the old transparent color opaque again */ if (im->transparent != -1) { im->alpha[im->transparent] = gdAlphaOpaque; } diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c index 0ff10b9..ca106ad 100644 --- a/ext/gd/libgd/gd_interpolation.c +++ b/ext/gd/libgd/gd_interpolation.c @@ -1247,7 +1247,13 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int if (new_img == NULL) { return NULL; } - new_img->transparent = gdTrueColorAlpha(im->red[transparent], im->green[transparent], im->blue[transparent], im->alpha[transparent]); + + if (transparent < 0) { + /* uninitialized */ + new_img->transparent = -1; + } else { + new_img->transparent = gdTrueColorAlpha(im->red[transparent], im->green[transparent], im->blue[transparent], im->alpha[transparent]); + } for (i=0; i < _height; i++) { long j; diff --git a/ext/gd/tests/bug72512.phpt b/ext/gd/tests/bug72512.phpt new file mode 100644 index 0000000..2a2024d --- /dev/null +++ b/ext/gd/tests/bug72512.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #19366 (gdimagefill() function crashes (fixed in bundled libgd)) +--SKIPIF-- +<?php + if (!extension_loaded('gd')) die("skip gd extension not available\n"); +?> +--FILE-- +<?php +$img = imagecreatetruecolor(100, 100); +imagecolortransparent($img, -1000000); +imagetruecolortopalette($img, TRUE, 3); +imagecolortransparent($img, 9); +echo "OK"; +?> +--EXPECT-- +OK +