- - Fixed #51128, imagefill() doesn't work with large images

diff --git a/NEWS b/NEWS
index 1fc1f95390a4619eb13ab6d827360db37e4652cc..a52393d738ab52e5daf56375e436ccfa381e346f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -54,6 +54,7 @@ PHP                                                                        NEWS
   (Ilia)
 - Fixed bug #51171 (curl_setopt() doesn't output any errors or warnings when 
   an invalid option is provided). (Ilia)
+- Fixed bug #51128 (imagefill() doesn't work with large images). (Pierre)
 - Fixed bug #51086 (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones)
 - Fixed bug #51062 (DBA DB4 uses mismatched headers and libraries). (Chris Jones)
 - Fixed bug #51023 (filter doesn't detect int overflows with GCC 4.4).

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index f7411e6397cbcfb2ef5d386241f46d9439d0294c..94934f5993d1dabb4c6f6f8981e43c56845ce029 100644 (file)
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1938,9 +1938,9 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 struct seg {int y, xl, xr, dy;};
 
 /* max depth of stack */
-#define FILL_MAX 1200000
+#define FILL_MAX ((int)(im->sy*im->sx)/4)
 #define FILL_PUSH(Y, XL, XR, DY) \
-    if (sp<stack+FILL_MAX*10 && Y+(DY)>=0 && Y+(DY)<wy2) \
+    if (sp<stack+FILL_MAX && Y+(DY)>=0 && Y+(DY)<wy2) \
     {sp->y = Y; sp->xl = XL; sp->xr = XR; sp->dy = DY; sp++;}
 
 #define FILL_POP(Y, XL, XR, DY) \