MFH: Fixed bug #45799 (imagepng() crashes on empty image)

diff --git a/NEWS b/NEWS
index 0e4f1681c895be20125009c9d2b838d092fba3b2..bb2b31f2e66c38a8a4cd01ec41d4bc0bad24f828 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,7 @@ PHP                                                                        NEWS
 - Fixed bug #46048 (SimpleXML top-level @attributes not part of iterator).
   (David C.)
 - Fixed bug #45432 (PDO: persistent connection leak). (Felipe)
+- Fixed bug #45799 (imagepng() crashes on empty image). (Martin McNickle, Takeshi Abe)
 - Fixed bug #43831 ($this gets mangled when extending PDO with persistent 
   connection). (Felipe)
 - Fixed PECL Bug #16035 (OCI8: oci_connect without ORACLE_HOME defined causes segfault) (Chris Jones/Oracle Corp.)

diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c
index 506958106ce2c4a812a8b13f067023a55a34d9de..6b9c81ec998a85e8902c8709084008a2d1f367f7 100644 (file)
--- a/ext/gd/libgd/gd_png.c
+++ b/ext/gd/libgd/gd_png.c
@@ -543,6 +543,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
                                ++colors;
                        }
                }
+               if (colors == 0) {
+                       php_gd_error("gd-png error: no colors in palette");
+                       goto bail;
+               }
                if (colors < im->colorsTotal) {
                        remap = TRUE;
                }
@@ -740,6 +744,7 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
                }
        }
        /* 1.6.3: maybe we should give that memory BACK! TBB */
+ bail:
        png_destroy_write_struct(&png_ptr, &info_ptr);
 }
 

diff --git a/ext/gd/tests/bug45799.phpt b/ext/gd/tests/bug45799.phpt
new file mode 100644 (file)
index 0000000..a28f940
--- /dev/null
+++ b/ext/gd/tests/bug45799.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #45799 (imagepng() crashes on empty image).
+--SKIPIF--
+<?php
+       if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$img = imagecreate(500,500);
+imagepng($img);
+imagedestroy($img);
+?>
+--EXPECTF--
+
+Warning: imagepng(): gd-png error: no colors in palette in %s on line %d