Fix bug #70976: fix boundary check on gdImageRotateInterpolated

php · Dec 8, 2015 · 4bb4223 · 4bb4223
1 parent 2e157c5
commit 4bb4223
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -4,6 +4,10 @@ PHP                                                                        NEWS
 
 ?? ??? 2015, PHP 5.5.31
 
+- GD:
+  . Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index
+    Out of Bounds). (emmanuel dot law at gmail dot com).
+
 01 Oct 2015, PHP 5.5.30
 
 - Phar:

diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c
@@ -2154,7 +2154,7 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in
 {
 	const int angle_rounded = (int)floor(angle * 100);
 
-	if (bgcolor < 0) {
+	if (bgcolor < 0 || bgcolor >= gdMaxColors) {
 		return NULL;
 	}
 

diff --git a/ext/gd/tests/bug70976.phpt b/ext/gd/tests/bug70976.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds)
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+?>
+--FILE--
+<?php
+$img = imagerotate(imagecreate(1,1),45,0x7ffffff9);
+var_dump($img);
+?>
+--EXPECTF--
+bool(false)