- - Fixed #51128, imagefill() doesn't work with large images

diff --git a/NEWS b/NEWS
index 73982130fe1c5d50d92dbf6163e84e4456983d73..2c54d5716741ca3d9c1faa006d89a02eb117e768 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -86,6 +86,7 @@ PHP                                                                        NEWS
   (Felipe)
 - Fixed bug #51171 (curl_setopt() doesn't output any errors or warnings when    
   an invalid option is provided). (Ilia)
+- Fixed bug #51128 (imagefill() doesn't work with large images). (Pierre)
 - Fixed bug #51096 ('last day' and 'first day' are handled incorrectly when
   parsing date strings). (Derick)
 - Fixed bug #51086 (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones)

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 0510bec14e43caf7b9619ae8cdd76278e778da27..0cc2e1d7de9f4e3914d85734e981da0fb2748f23 100644 (file)
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1845,9 +1845,9 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 struct seg {int y, xl, xr, dy;};
 
 /* max depth of stack */
-#define FILL_MAX 1200000
+#define FILL_MAX ((int)(im->sy*im->sx)/4)
 #define FILL_PUSH(Y, XL, XR, DY) \
-    if (sp<stack+FILL_MAX*10 && Y+(DY)>=0 && Y+(DY)<wy2) \
+    if (sp<stack+FILL_MAX && Y+(DY)>=0 && Y+(DY)<wy2) \
     {sp->y = Y; sp->xl = XL; sp->xr = XR; sp->dy = DY; sp++;}
 
 #define FILL_POP(Y, XL, XR, DY) \