Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 4dad95ae3930bf1d225b604cdeed9200704fde7a..3a9577859e962badfb6311de64343d7bc6444eb3 100644 (file)
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -599,15 +599,18 @@ void gdImageColorDeallocate (gdImagePtr im, int color)
 
 void gdImageColorTransparent (gdImagePtr im, int color)
 {
+       if (color < 0) {
+               return;
+       }
+
        if (!im->trueColor) {
+               if((color >= gdMaxColors)) {
+                       return;
+               }
                if (im->transparent != -1) {
                        im->alpha[im->transparent] = gdAlphaOpaque;
                }
-               if (color > -1 && color < im->colorsTotal && color < gdMaxColors) {
-                       im->alpha[color] = gdAlphaTransparent;
-               } else {
-                       return;
-               }
+               im->alpha[color] = gdAlphaTransparent;
        }
        im->transparent = color;
 }