- MFB: Fixed bug #28147 (Crash with drawing anti-alised lines)

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 8484c4cf392c87d3c3ed33c0d018ffe22fa5a28e..7cfcd64f90644a7113de95b726a508d2b066d8b8 100644 (file)
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1288,7 +1288,9 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
                inc = (dy * 65536) / dx;
                while ((x >> 16) < x2) {
                        gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (y >> 8) & 0xFF);
-                       gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF);
+                       if ((y >> 16) + 1 < im->sy) {
+                               gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF);
+                       }
                        x += (1 << 16);
                        y += inc;
                }
@@ -1308,7 +1310,9 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
                inc = (dx * 65536) / dy;
                while ((y>>16) < y2) {
                        gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (x >> 8) & 0xFF);
-                       gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF);
+                       if ((x >> 16) + 1 < im->sx) {
+                               gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF);
+                       }
                        x += inc;
                        y += (1<<16);
                }

diff --git a/ext/gd/tests/bug28147.phpt b/ext/gd/tests/bug28147.phpt
new file mode 100644 (file)
index 0000000..b3551a6
--- /dev/null
+++ b/ext/gd/tests/bug28147.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #28147 (Crash with anti-aliased line)
+--SKIPIF--
+<?php 
+       if (!extension_loaded('gd')) die("skip gd extension not available\n"); 
+       if (!GD_BUNDLED) die('skip external GD libraries always fail');
+?>
+--FILE--
+<?php
+//
+// This script will generate a Seg Fault on Linux
+//
+$im  = imagecreatetruecolor(300, 300);
+$w  = imagecolorallocate($im, 255, 255, 255);
+$red = imagecolorallocate($im, 255, 0, 0);
+                                                                                                                                
+imagefilledrectangle($im,0,0,299,299,$w);
+                                                                                                                                
+imageantialias($im,true);
+imageline($im, 299, 299, 0, 299, $red);
+                                                                                                                                
+imagedestroy($im);
+
+echo "Alive\n";
+?>
+--EXPECT--
+Alive