Commit Graph

9 Commits

Author SHA1 Message Date
Christoph M. Becker
891ff131ef Fix #67447: imagecrop() adds a black line when cropping
A simple one-off error: imagecrop)() copied only width-1 and height-1 pixels.
2015-07-12 23:05:53 +02:00
Remi Collet
af09d8b96a Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327
This amends commit 8f4a537, which aimed to correct NULL dereference because of
missing check of gdImageCreateTrueColor() / gdImageCreate() return value.  That
commit checks for negative crop rectangle width and height, but
gdImageCreate*() can also return NULL when width * height overflows.  Hence
NULL deref is still possible, as gdImageSaveAlpha() and gdImagePaletteCopy()
is called before dst == NULL check.

This moves NULL check to happen right after gdImageCreate*().  It also removes
width and height check before gdImageCreate*(), as the same check is done by
image create functions (with an extra warning).

From thoger redhat com
2014-03-05 10:40:36 +01:00
Remi Collet
464c219ed4 minor fix on previous 2013-12-28 14:29:14 +01:00
Remi Collet
8f4a5373bb Fixed bug #66356 (Heap Overflow Vulnerability in imagecrop())
Initial fix was PHP stuff
This one is libgd fix.

- filter invalid crop size
- dont try to copy on invalid position
- fix crop size when out of src image
- fix possible NULL deref
- fix possible integer overfloow
2013-12-28 14:22:13 +01:00
Veres Lajos
72085b0e5f typo fixes 2013-07-15 00:18:57 -07:00
Pierre Joye
0a55c4b1dd - (s)rgb distance works way better for now, re enable threshold 2013-03-03 05:30:12 +01:00
Pierre Joye
22aeb976e0 - add todo for threshold 2013-02-28 19:34:14 +01:00
Pierre Joye
0c32a18d4c - clean and enable threshold 2013-02-28 19:22:06 +01:00
Pierre Joye
a991360344 - add image crop support 2013-02-28 17:24:23 +01:00