- MFH: fix segfault/leak in imagecolormatch

- MFH: test for imagecolormatch

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 5fe9ecdfcce681ecaafa966695cd72b67fb60376..0908f608e4a7ba51d177b9a7a3f2b834fcc85fe7 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -930,6 +930,10 @@ PHP_FUNCTION(imagecolormatch)
                        php_error_docref(NULL TSRMLS_CC, E_ERROR, "Image1 and Image2 must be the same size" );
                        RETURN_FALSE;
                        break;
+               case -4:
+                       php_error_docref(NULL TSRMLS_CC, E_ERROR, "Image2 must have at least one color" );
+                       RETURN_FALSE;
+                       break;
        }
 
        RETURN_TRUE;

diff --git a/ext/gd/libgd/gd_topal.c b/ext/gd/libgd/gd_topal.c
index 15eed3e11ee71a18de0b0508c97cbbf71f722830..2d7db8c73fa490140d8c60674d508ef38a163e40 100644 (file)
--- a/ext/gd/libgd/gd_topal.c
+++ b/ext/gd/libgd/gd_topal.c
@@ -2086,6 +2086,9 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2)
        if( (im1->sx != im2->sx) || (im1->sy != im2->sy) ) {
                return -3; /* the images are meant to be the same dimensions */
        }
+       if (im2->colorsTotal<1) {
+               return -4; /* At least 1 color must be allocated */
+       }
 
        buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0);
        memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal );

diff --git a/ext/gd/tests/colormatch.phpt b/ext/gd/tests/colormatch.phpt
new file mode 100644 (file)
index 0000000..d940914
--- /dev/null
+++ b/ext/gd/tests/colormatch.phpt
@@ -0,0 +1,21 @@
+--TEST--
+imagecolormatch
+--SKIPIF--
+<?php
+        if (!function_exists('imagecolormatch')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+
+$im = imagecreatetruecolor(5,5);
+$im2 = imagecreate(5,5);
+
+imagecolormatch($im, $im2);
+
+echo "ok\n";
+
+imagedestroy($im);
+?>
+--EXPECTF--
+Fatal error: imagecolormatch(): Image2 must have at least one color in %s on line %d
+