Skip to content
Permalink
Browse files

Fix bug #70976: fix boundary check on gdImageRotateInterpolated

  • Loading branch information...
smalyshev committed Dec 8, 2015
1 parent 2e157c5 commit 4bb422343f29f06b7081323844d9b52e1a71e4a5
Showing with 18 additions and 1 deletion.
  1. +4 −0 NEWS
  2. +1 −1 ext/gd/libgd/gd_interpolation.c
  3. +13 −0 ext/gd/tests/bug70976.phpt
4 NEWS
@@ -4,6 +4,10 @@ PHP NEWS

?? ??? 2015, PHP 5.5.31

- GD:
. Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index
Out of Bounds). (emmanuel dot law at gmail dot com).

01 Oct 2015, PHP 5.5.30

- Phar:
@@ -2154,7 +2154,7 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in
{
const int angle_rounded = (int)floor(angle * 100);

if (bgcolor < 0) {
if (bgcolor < 0 || bgcolor >= gdMaxColors) {
return NULL;
}

@@ -0,0 +1,13 @@
--TEST--
Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds)
--SKIPIF--
<?php
if(!extension_loaded('gd')){ die('skip gd extension not available'); }
?>
--FILE--
<?php
$img = imagerotate(imagecreate(1,1),45,0x7ffffff9);
var_dump($img);
?>
--EXPECTF--
bool(false)

0 comments on commit 4bb4223

Please sign in to comment.
You can’t perform that action at this time.