fix #72512, invalid read or write for palette image when invalid transparent index...

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 4dad95ae3930bf1d225b604cdeed9200704fde7a..927ecc54390e755e953faf6cdb9516afcdc5f454 100644 (file)
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -599,15 +599,18 @@ void gdImageColorDeallocate (gdImagePtr im, int color)
 
 void gdImageColorTransparent (gdImagePtr im, int color)
 {
+       if (color < 0) {
+               return;
+       }
        if (!im->trueColor) {
+               if((color >= im->colorsTotal)) {
+                       return;
+               }
+               /* Make the old transparent color opaque again */
                if (im->transparent != -1) {
                        im->alpha[im->transparent] = gdAlphaOpaque;
                }
-               if (color > -1 && color < im->colorsTotal && color < gdMaxColors) {
-                       im->alpha[color] = gdAlphaTransparent;
-               } else {
-                       return;
-               }
+               im->alpha[color] = gdAlphaTransparent;
        }
        im->transparent = color;
 }

diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c
index 4fa23f0a1469a5e8cf2e43d02ec66d4b18521d3e..81ea88525a27e59973a122c249fbdf38828ce8a6 100644 (file)
--- a/ext/gd/libgd/gd_interpolation.c
+++ b/ext/gd/libgd/gd_interpolation.c
@@ -1225,7 +1225,13 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
        if (new_img == NULL) {
                return NULL;
        }
-       new_img->transparent = gdTrueColorAlpha(im->red[transparent], im->green[transparent], im->blue[transparent], im->alpha[transparent]);
+
+       if (transparent < 0) {
+               /* uninitialized */
+               new_img->transparent = -1;
+       } else {
+               new_img->transparent = gdTrueColorAlpha(im->red[transparent], im->green[transparent], im->blue[transparent], im->alpha[transparent]);
+       }
 
        for (i=0; i < _height; i++) {
                long j;

diff --git a/ext/gd/tests/bug72512.phpt b/ext/gd/tests/bug72512.phpt
new file mode 100644 (file)
index 0000000..2a2024d
--- /dev/null
+++ b/ext/gd/tests/bug72512.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #19366 (gdimagefill() function crashes (fixed in bundled libgd))
+--SKIPIF--
+<?php
+       if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$img = imagecreatetruecolor(100, 100);
+imagecolortransparent($img, -1000000);
+imagetruecolortopalette($img, TRUE, 3);
+imagecolortransparent($img, 9);
+echo "OK";
+?>
+--EXPECT--
+OK
+