com php-src: Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access: ext/gd/libgd/gd.c

Commit: 7b2c22696ad44df1d26d70e15521adebd95c0399 Author: Pierre Joye <pajoye@php.net> Mon, 4 Jul 2016 10:35:20 +0200 Committer: Anatol Belski <ab@php.net> Mon, 4 Jul 2016 10:35:20 +0200 Parents: cab1c3b3708eead315e033359d07049b23b147a3 Branches: PHP-5.5 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=7b2c22696ad44df1d26d70e15521adebd95c0399 Log: Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access Bugs: https://bugs.php.net/72512 Changed paths: M ext/gd/libgd/gd.c Diff: diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index 4dad95a..3a95778 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -599,15 +599,18 @@ void gdImageColorDeallocate (gdImagePtr im, int color) void gdImageColorTransparent (gdImagePtr im, int color) { + if (color < 0) { + return; + } + if (!im->trueColor) { + if((color >= gdMaxColors)) { + return; + } if (im->transparent != -1) { im->alpha[im->transparent] = gdAlphaOpaque; } - if (color > -1 && color < im->colorsTotal && color < gdMaxColors) { - im->alpha[color] = gdAlphaTransparent; - } else { - return; - } + im->alpha[color] = gdAlphaTransparent; } im->transparent = color; }