Fixed bug #45799 (imagepng() crashes on empty image)

diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c
index 773e652247fe8f74db866b86463376fa037c1765..296f93431019dddc006e47b8597505cbbe3cafbf 100644 (file)
--- a/ext/gd/libgd/gd_png.c
+++ b/ext/gd/libgd/gd_png.c
@@ -544,6 +544,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
                                ++colors;
                        }
                }
+               if (colors == 0) {
+                       php_gd_error("gd-png error: no colors in palette");
+                       goto bail;
+               }
                if (colors < im->colorsTotal) {
                        remap = TRUE;
                }
@@ -741,6 +745,7 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
                }
        }
        /* 1.6.3: maybe we should give that memory BACK! TBB */
+ bail:
        png_destroy_write_struct(&png_ptr, &info_ptr);
 }
 

diff --git a/ext/gd/tests/bug45799.phpt b/ext/gd/tests/bug45799.phpt
new file mode 100644 (file)
index 0000000..a28f940
--- /dev/null
+++ b/ext/gd/tests/bug45799.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #45799 (imagepng() crashes on empty image).
+--SKIPIF--
+<?php
+       if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$img = imagecreate(500,500);
+imagepng($img);
+imagedestroy($img);
+?>
+--EXPECTF--
+
+Warning: imagepng(): gd-png error: no colors in palette in %s on line %d