mirror of
https://github.com/php/php-src.git
synced 2024-09-22 02:17:32 +00:00
Fix #77270: imagecolormatch Out Of Bounds Write on Heap
At least some of the image reading functions may return images which use color indexes greater than or equal to im->colorsTotal. We cater to this by always using a buffer size which is sufficient for `gdMaxColors` in `gdImageColorMatch()`.
This commit is contained in:
parent
4feb9e66ff
commit
567c9f5842
@ -33,8 +33,8 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2)
|
||||
return -4; /* At least 1 color must be allocated */
|
||||
}
|
||||
|
||||
buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0);
|
||||
memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal );
|
||||
buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * gdMaxColors, 0);
|
||||
memset( buf, 0, sizeof(unsigned long) * 5 * gdMaxColors );
|
||||
|
||||
for (x=0; x<im1->sx; x++) {
|
||||
for( y=0; y<im1->sy; y++ ) {
|
||||
|
18
ext/gd/tests/bug77270.phpt
Normal file
18
ext/gd/tests/bug77270.phpt
Normal file
@ -0,0 +1,18 @@
|
||||
--TEST--
|
||||
Bug #77270 (imagecolormatch Out Of Bounds Write on Heap)
|
||||
--SKIPIF--
|
||||
<?php
|
||||
if (!extension_loaded('gd')) die('skip gd extension not available');
|
||||
if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream bugfix has not been released');
|
||||
?>
|
||||
--FILE--
|
||||
<?php
|
||||
$img1 = imagecreatetruecolor(0xfff, 0xfff);
|
||||
$img2 = imagecreate(0xfff, 0xfff);
|
||||
imagecolorallocate($img2, 0, 0, 0);
|
||||
imagesetpixel($img2, 0, 0, 255);
|
||||
imagecolormatch($img1, $img2);
|
||||
?>
|
||||
===DONE===
|
||||
--EXPECT--
|
||||
===DONE===
|
Loading…
Reference in New Issue
Block a user