com php-src: Fix #72696: imagefilltoborder stackoverflow on truecolor images: ext/gd/libgd/gd.c ext/gd/tests/bug72696.phpt

Commit: a05e84c42bfbff1f2ab17dfcb3311b55ff63f0a1 Author: Christoph M. Becker <cmbecker69@gmx.de> Tue, 25 Oct 2016 13:23:16 +0200 Committer: Anatol Belski <ab@php.net> Tue, 8 Nov 2016 13:02:19 +0100 Parents: bf00354cb75ed9523db1f7f1c88357fe1d8710ef Branches: PHP-7.0.13 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=a05e84c42bfbff1f2ab17dfcb3311b55ff63f0a1 Log: Fix #72696: imagefilltoborder stackoverflow on truecolor images We must not allow negative color values be passed to gdImageFillToBorder(), because that can lead to infinite recursion since the recursion termination condition will not necessarily be met. (cherry picked from commit 863d37ea66d5c960db08d6f4a2cbd2518f0f80d1) (cherry picked from commit 5693474997b5a804be307583fb7bc3cfcdd50aec) Bugs: https://bugs.php.net/72696 Changed paths: M ext/gd/libgd/gd.c A ext/gd/tests/bug72696.phpt Diff: diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index 0673a8d..8d1e48d 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -1745,7 +1745,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color) int leftLimit = -1, rightLimit; int i, restoreAlphaBlending = 0; - if (border < 0) { + if (border < 0 || color < 0) { /* Refuse to fill to a non-solid border */ return; } diff --git a/ext/gd/tests/bug72696.phpt b/ext/gd/tests/bug72696.phpt new file mode 100644 index 0000000..4f0d9e7 --- /dev/null +++ b/ext/gd/tests/bug72696.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #72696 (imagefilltoborder stackoverflow on truecolor images) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$im = imagecreatetruecolor(10, 10); +imagefilltoborder($im, 0, 0, 1, -2); +?> +===DONE=== +--EXPECT-- +===DONE===