- #38212, Segfault on invalid imagecreatefromgd2part() parameters

diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c
index 1e739179e2c75d2b83e26bf5dfecf816004c925a..3f24e4a4769d328028226bb462568ddffcea6d4c 100644 (file)
--- a/ext/gd/libgd/gd_gd2.c
+++ b/ext/gd/libgd/gd_gd2.c
@@ -430,6 +430,10 @@ gdImagePtr gdImageCreateFromGd2PartCtx (gdIOCtx * in, int srcx, int srcy, int w,
 
        gdImagePtr im;
 
+       if (w<1 || h <1) {
+               return 0;
+       }
+
        /* The next few lines are basically copied from gd2CreateFromFile
         * we change the file size, so don't want to use the code directly.
         * but we do need to know the file size.

diff --git a/ext/gd/tests/bug38212.phpt b/ext/gd/tests/bug38212.phpt
new file mode 100644 (file)
index 0000000..0094712
--- /dev/null
+++ b/ext/gd/tests/bug38212.phpt
@@ -0,0 +1,17 @@
+--TEST--
+imagecopy doen't copy alpha, palette to truecolor
+--SKIPIF--
+<?php
+        if (!function_exists('imagecopy')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$file = dirname(__FILE__) . '/bug38212.gd2';
+$im1 = imagecreatetruecolor(10,100);
+imagefill($im1, 0,0, 0xffffff);
+imagegd2($im1, $file);
+$im = imagecreatefromgd2part($file, 0,0, -25,10);
+unlink($file);
+?>
+--EXPECTF--
+Warning: imagecreatefromgd2part(): '%sbug38212.gd2' is not a valid GD2 file in %sbug38212.php on line %d