MFH: fix #34996 (ImageTrueColorToPalette() crashes when ncolors is zero)

diff --git a/NEWS b/NEWS
index 7186bb46779a6f3c68ac1e0eb222fc3f9aee2330..8098fe181e17ba23fbc8e405d8d078d1218a7923 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Oct 2005, PHP 5.1 Release Candidate 4
 - Fixed fgetcsv() and fputcsv() inconsistency. (Dmitry)
+- Fixed bug #34996 (ImageTrueColorToPalette() crashes when ncolors is 
+  zero). (Tony)
 - Fixed bug #34977 (Compile failure on MacOSX due to use of varargs.h). (Tony)
 - Fixed bug #34968 (bz2 extension fails on to build on some win32 setups).
   (Ilia)

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 0b8a2cc7d91852d9ba21850f1c64cfc389afa829..66ce0b2d5a09950746901c519dced352ccdf5083 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -890,6 +890,10 @@ PHP_FUNCTION(imagetruecolortopalette)
        convert_to_boolean_ex(dither);
        convert_to_long_ex(ncolors);
 
+       if (Z_LVAL_PP(ncolors) <= 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of colors has to be greater than zero");
+               RETURN_FALSE;
+       }
        gdImageTrueColorToPalette(im, Z_LVAL_PP(dither), Z_LVAL_PP(ncolors));
 
        RETURN_TRUE;