com php-src: Fix #72696: imagefilltoborder stackoverflow on truecolor images: ext/gd/libgd/gd.c ext/gd/tests/bug72696.phpt

Commit: 7c27d0329f730d701d18e66db7e85ef7d128712b Author: Christoph M. Becker <cmbecker69@gmx.de> Tue, 25 Oct 2016 13:23:16 +0200 Committer: Ferenc Kovacs <tyra3l@gmail.com> Wed, 9 Nov 2016 01:46:37 +0100 Parents: dd8a2cc2455e61c4507b8f419d345da90fa08238 Branches: PHP-5.6.28 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=7c27d0329f730d701d18e66db7e85ef7d128712b Log: Fix #72696: imagefilltoborder stackoverflow on truecolor images We must not allow negative color values be passed to gdImageFillToBorder(), because that can lead to infinite recursion since the recursion termination condition will not necessarily be met. Bugs: https://bugs.php.net/72696 Changed paths: M ext/gd/libgd/gd.c A ext/gd/tests/bug72696.phpt Diff: diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index 058f1c9..3e7d27a 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -1747,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color) int leftLimit = -1, rightLimit; int i, restoreAlphaBlending = 0; - if (border < 0) { + if (border < 0 || color < 0) { /* Refuse to fill to a non-solid border */ return; } diff --git a/ext/gd/tests/bug72696.phpt b/ext/gd/tests/bug72696.phpt new file mode 100644 index 0000000..4f0d9e7 --- /dev/null +++ b/ext/gd/tests/bug72696.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #72696 (imagefilltoborder stackoverflow on truecolor images) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$im = imagecreatetruecolor(10, 10); +imagefilltoborder($im, 0, 0, 1, -2); +?> +===DONE=== +--EXPECT-- +===DONE===