Fix segfault in imagecopyresized().

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 605b829de4a3cf941eb62a9f43f96c1379b1996e..d4b771454d689cc6c3398537ea80ca880d4531d7 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -2946,6 +2946,11 @@ PHP_FUNCTION(imagecopyresized)
        dstY = Z_LVAL_PP(DY);
        dstH = Z_LVAL_PP(DH);
        dstW = Z_LVAL_PP(DW);
+       
+       if (dstW < 0 || dstH < 0 || srcW < 0 || srcH < 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid image dimensions");
+               RETURN_FALSE;
+       }
 
        gdImageCopyResized(im_dst, im_src, dstX, dstY, srcX, srcY, dstW, dstH, srcW, srcH);
        RETURN_TRUE;