Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix integer overflow in gdImageWebpCtx #296

Merged
merged 1 commit into from Sep 16, 2016

Conversation

Projects
None yet
2 participants
@trylab
Copy link
Contributor

trylab commented Sep 6, 2016

Integer overflow can be happened in expression gdImageSX(im) * 4 * gdImageSY(im). It could lead to heap buffer overflow in the following code.

This issue has been reported to the PHP Bug Tracking System. The proof-of-concept file will be supplied some days later.

This issue was discovered by Ke Liu of Tencent's Xuanwu LAB.

Fix integer overflow in gdImageWebpCtx
Integer overflow can be happened in expression gdImageSX(im) * 4 *
gdImageSY(im). It could lead to heap buffer overflow in the following
code. This issue has been reported to the PHP Bug Tracking System. The
proof-of-concept file will be supplied some days later. This issue was
discovered by Ke Liu of Tencent's Xuanwu LAB.

@cmb69 cmb69 merged commit 2806adf into libgd:master Sep 16, 2016

1 check passed

continuous-integration/travis-ci/pr The Travis CI build passed
Details
@cmb69

This comment has been minimized.

Copy link
Contributor

cmb69 commented Sep 16, 2016

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.