Fix segfaults in imagecreate/imagecreatetruecolor

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 1db01779e8272ff4cf9ac580354def15068b1d64..53fc513ea1de252c5ed625822ffcf711231970dd 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -800,6 +800,12 @@ PHP_FUNCTION(imagecreatetruecolor)
        convert_to_long_ex(x_size);
        convert_to_long_ex(y_size);
 
+       if (Z_LVAL_PP(x_size) <= 0
+                       || Z_LVAL_PP(y_size) <= 0) {
+               php_error(E_WARNING, "invalid image dimensions");
+               RETURN_FALSE;
+       }
+       
        im = gdImageCreateTrueColor(Z_LVAL_PP(x_size), Z_LVAL_PP(y_size));
 
        ZEND_REGISTER_RESOURCE(return_value, im, le_gd);
@@ -1243,6 +1249,12 @@ PHP_FUNCTION(imagecreate)
        convert_to_long_ex(x_size);
        convert_to_long_ex(y_size);
 
+       if (Z_LVAL_PP(x_size) <= 0
+                       || Z_LVAL_PP(y_size) <= 0) {
+               php_error(E_WARNING, "invalid image dimensions");
+               RETURN_FALSE;
+       }
+
        im = gdImageCreate(Z_LVAL_PP(x_size), Z_LVAL_PP(y_size));
 
        ZEND_REGISTER_RESOURCE(return_value, im, le_gd);