- MFB: #38112, corrupt GIF Image segfault

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 0b20c6bc30358b9794a87dc3942a3078efe68c5b..382b2804cee5716bafbaa84474cb1cd852fa9f11 100644 (file)
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -216,6 +216,12 @@ terminated:
        if (!im) {
                return 0;
        }
+
+       if (!im->colorsTotal) {
+               gdImageDestroy(im);
+               return 0;
+       }
+
        /* Check for open colors at the end, so
           we can reduce colorsTotal and ultimately
           BitsPerPixel */
@@ -499,6 +505,18 @@ static void ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned
        int             v;
        int             xpos = 0, ypos = 0, pass = 0;
        int i;
+
+       /*
+        **  Initialize the Compression routines
+        */
+       if (! ReadOK(fd,&c,1)) {
+               return;
+       }
+
+       if (c > MAX_LWZ_BITS) {
+               return; 
+       }
+
        /* Stash the color map into the image */
        for (i=0; (i<gdMaxColors); i++) {
                im->red[i] = cmap[CM_RED][i];
@@ -508,12 +526,6 @@ static void ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned
        }
        /* Many (perhaps most) of these colors will remain marked open. */
        im->colorsTotal = gdMaxColors;
-       /*
-        **  Initialize the Compression routines
-        */
-       if (! ReadOK(fd,&c,1)) {
-               return;
-       }
        if (LWZReadByte(fd, TRUE, c) < 0) {
                return;
        }

diff --git a/ext/gd/tests/bug38112.gif b/ext/gd/tests/bug38112.gif
new file mode 100644 (file)
index 0000000..178d27e
Binary files /dev/null and b/ext/gd/tests/bug38112.gif differ

diff --git a/ext/gd/tests/bug38112.phpt b/ext/gd/tests/bug38112.phpt
new file mode 100644 (file)
index 0000000..6c52271
--- /dev/null
+++ b/ext/gd/tests/bug38112.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #38112 (GIF Invalid Code size ).
+--SKIPIF--
+<?php 
+       if (!extension_loaded('gd')) {  
+               die("skip gd extension not available\n");
+       }
+       if (!GD_BUNDLED) {
+               die('skip external GD libraries may fail');
+       }
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(dirname(__FILE__) . '/bug38112.gif');
+?>
+--EXPECTF--
+Warning: imagecreatefromgif(): '%sbug38112.gif' is not a valid GIF file in %sbug38112.php on line %d