Fix memory leak in imagescale()

diff --git a/NEWS b/NEWS
index f824cea0e0862e28054899e24b05649c13058dc2..afc6fa77d934a9d00fcb2ece51524c5c7b9b10e1 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,7 +10,7 @@ PHP                                                                        NEWS
   . Fixed bug #72135 (Integer Overflow in php_html_entities). (Stas)
 
 - GD:
-   . Fixed bug ##72227 (imagescale out-of-bounds read). (Stas)
+   . Fixed bug #72227 (imagescale out-of-bounds read). (Stas)
 
 - Intl:
    . Fixed bug #72241 (get_icu_value_internal out-of-bounds read). (Stas)

diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c
index a017498383017839f587f31c775d504cb02148e8..0961c0804801373fe125f0083f88281244036492 100644 (file)
--- a/ext/gd/libgd/gd_interpolation.c
+++ b/ext/gd/libgd/gd_interpolation.c
@@ -1070,12 +1070,12 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 
        dst = gdImageCreateTrueColor(new_width, new_height);
        if (dst == NULL) {
-               gdFree(tmp_im);
+               gdImageDestroy(tmp_im);
                return NULL;
        }
        gdImageSetInterpolationMethod(dst, src->interpolation_id);
        _gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
-       gdFree(tmp_im);
+       gdImageDestroy(tmp_im);
 
        return dst;
 }
@@ -1093,7 +1093,7 @@ gdImagePtr Scale(const gdImagePtr src, const unsigned int src_width, const unsig
        _gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
        _gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
 
-       gdFree(tmp_im);
+       gdImageDestroy(tmp_im);
        return dst;
 }