fix php 72494, invalid color index not handled, can lead to crash

libgd · Jun 27, 2016 · 1ccfe21 · 1ccfe21
1 parent 3fe0a71
commit 1ccfe21
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/src/gd_crop.c b/src/gd_crop.c
@@ -136,6 +136,10 @@ BGD_DECLARE(gdImagePtr) gdImageCropThreshold(gdImagePtr im, const unsigned int c
 		return NULL;
 	}
 
+	if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
+		return NULL;
+	}
+
 	/* TODO: Add gdImageGetRowPtr and works with ptr at the row level
 	 * for the true color and palette images
 	 * new formats will simply work with ptr

diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
@@ -31,6 +31,7 @@ if (BUILD_TEST)
 		gdimagecolortransparent
 		gdimagecopy
 		gdimagecopyrotated
+        gdimagecrop
 		gdimagefile
 		gdimagefill
 		gdimagefilledellipse

diff --git a/tests/Makefile.am b/tests/Makefile.am
@@ -25,6 +25,7 @@ include gdimagecolorresolve/Makemodule.am
 include gdimagecolortransparent/Makemodule.am
 include gdimagecopy/Makemodule.am
 include gdimagecopyrotated/Makemodule.am
+include gdimagecrop/Makemodule.am
 include gdimagefile/Makemodule.am
 include gdimagefill/Makemodule.am
 include gdimagefilledellipse/Makemodule.am