Skip to content

Commit 863d37e

Browse files
cmb69smalyshev
authored andcommitted
Fix #72696: imagefilltoborder stackoverflow on truecolor images
We must not allow negative color values be passed to gdImageFillToBorder(), because that can lead to infinite recursion since the recursion termination condition will not necessarily be met.
1 parent 6499581 commit 863d37e

File tree

2 files changed

+15
-1
lines changed

2 files changed

+15
-1
lines changed

Diff for: ext/gd/libgd/gd.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -1747,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
17471747
int leftLimit = -1, rightLimit;
17481748
int i, restoreAlphaBlending = 0;
17491749

1750-
if (border < 0) {
1750+
if (border < 0 || color < 0) {
17511751
/* Refuse to fill to a non-solid border */
17521752
return;
17531753
}

Diff for: ext/gd/tests/bug72696.phpt

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('gd')) die('skip gd extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
$im = imagecreatetruecolor(10, 10);
10+
imagefilltoborder($im, 0, 0, 1, -2);
11+
?>
12+
===DONE===
13+
--EXPECT--
14+
===DONE===

0 commit comments

Comments
 (0)