#72482, Ilegal write/read access caused by gdImageAALine overflow

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index fc63cd379c5b12edc6f9aa67ab41a86f6c069fe7..49867b1f2a6ac6265e719ad8cd2901b8dd604374 100644 (file)
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1301,55 +1301,10 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
        long x, y, inc;
        long dx, dy,tmp;
 
-       if (y1 < 0 && y2 < 0) {
-               return;
-       }
-       if (y1 < 0) {
-               x1 += (y1 * (x1 - x2)) / (y2 - y1);
-               y1 = 0;
-       }
-       if (y2 < 0) {
-               x2 += (y2 * (x1 - x2)) / (y2 - y1);
-               y2 = 0;
-       }
-
-       /* bottom edge */
-       if (y1 >= im->sy && y2 >= im->sy) {
-               return;
-       }
-       if (y1 >= im->sy) {
-               x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1);
-               y1 = im->sy - 1;
-       }
-       if (y2 >= im->sy) {
-               x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1);
-               y2 = im->sy - 1;
-       }
-
-       /* left edge */
-       if (x1 < 0 && x2 < 0) {
-               return;
-       }
-       if (x1 < 0) {
-               y1 += (x1 * (y1 - y2)) / (x2 - x1);
-               x1 = 0;
-       }
-       if (x2 < 0) {
-               y2 += (x2 * (y1 - y2)) / (x2 - x1);
-               x2 = 0;
-       }
-       /* right edge */
-       if (x1 >= im->sx && x2 >= im->sx) {
+       /* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
+       if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) {
                return;
        }
-       if (x1 >= im->sx) {
-               y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1);
-               x1 = im->sx - 1;
-       }
-       if (x2 >= im->sx) {
-               y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1);
-               x2 = im->sx - 1;
-       }
 
        dx = x2 - x1;
        dy = y2 - y1;