Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix #72696: imagefilltoborder stackoverflow on truecolor images
We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
  • Loading branch information
cmb69 authored and smalyshev committed Oct 30, 2016
1 parent 6499581 commit 863d37e
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 1 deletion.
2 changes: 1 addition & 1 deletion ext/gd/libgd/gd.c
Expand Up @@ -1747,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
int leftLimit = -1, rightLimit;
int i, restoreAlphaBlending = 0;

if (border < 0) {
if (border < 0 || color < 0) {
/* Refuse to fill to a non-solid border */
return;
}
Expand Down
14 changes: 14 additions & 0 deletions ext/gd/tests/bug72696.phpt
@@ -0,0 +1,14 @@
--TEST--
Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
--SKIPIF--
<?php
if (!extension_loaded('gd')) die('skip gd extension not available');
?>
--FILE--
<?php
$im = imagecreatetruecolor(10, 10);
imagefilltoborder($im, 0, 0, 1, -2);
?>
===DONE===
--EXPECT--
===DONE===

0 comments on commit 863d37e

Please sign in to comment.