MFH: Fixed bug #45799 (imagepng() crashes on empty image)

diff --git a/NEWS b/NEWS
index 1f225749975ce2f5ead5faca8adca0d7335f986e..4975943ec40aa56674eb6c7831fcd58cf0c1b6da 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,8 @@ PHP                                                                        NEWS
   addresses in the filter extension). (Ilia)
 - Fixed bug #47430 (Errors after writing to nodeValue parameter of an absent 
   previousSibling). (Rob)
+- Fixed bug #45799 (imagepng() crashes on empty image). (Martin McNickle,
+  Takeshi Abe)
 
 26 Feb 2009, PHP 5.2.9
 - Changed __call() to be invoked on private/protected method access, similar to

diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c
index 7591dc0c673ece5e0097dfa319a73713e22e05a0..bb53e0d88c17c27d6d19406954fba10b24edf79f 100644 (file)
--- a/ext/gd/libgd/gd_png.c
+++ b/ext/gd/libgd/gd_png.c
@@ -535,6 +535,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
                                ++colors;
                        }
                }
+               if (colors == 0) {
+                       php_gd_error("gd-png error: no colors in palette");
+                       goto bail;
+               }
                if (colors < im->colorsTotal) {
                        remap = TRUE;
                }
@@ -732,6 +736,7 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
                }
        }
        /* 1.6.3: maybe we should give that memory BACK! TBB */
+ bail:
        png_destroy_write_struct(&png_ptr, &info_ptr);
 }
 

diff --git a/ext/gd/tests/bug45799.phpt b/ext/gd/tests/bug45799.phpt
new file mode 100644 (file)
index 0000000..a28f940
--- /dev/null
+++ b/ext/gd/tests/bug45799.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #45799 (imagepng() crashes on empty image).
+--SKIPIF--
+<?php
+       if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$img = imagecreate(500,500);
+imagepng($img);
+imagedestroy($img);
+?>
+--EXPECTF--
+
+Warning: imagepng(): gd-png error: no colors in palette in %s on line %d