Skip to content
Permalink
Browse files

Fix #72696: imagefilltoborder stackoverflow on truecolor images

We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
  • Loading branch information...
cmb69 authored and smalyshev committed Oct 25, 2016
1 parent 6499581 commit 863d37ea66d5c960db08d6f4a2cbd2518f0f80d1
Showing with 15 additions and 1 deletion.
  1. +1 −1 ext/gd/libgd/gd.c
  2. +14 −0 ext/gd/tests/bug72696.phpt
@@ -1747,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
int leftLimit = -1, rightLimit;
int i, restoreAlphaBlending = 0;

if (border < 0) {
if (border < 0 || color < 0) {
/* Refuse to fill to a non-solid border */
return;
}
@@ -0,0 +1,14 @@
--TEST--
Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
--SKIPIF--
<?php
if (!extension_loaded('gd')) die('skip gd extension not available');
?>
--FILE--
<?php
$im = imagecreatetruecolor(10, 10);
imagefilltoborder($im, 0, 0, 1, -2);
?>
===DONE===
--EXPECT--
===DONE===

0 comments on commit 863d37e

Please sign in to comment.
You can’t perform that action at this time.