From: Pierre Joye <pajoye@php.net>
Date: Wed, 28 Apr 2010 14:35:42 +0000 (+0000)
Subject: - - Fixed #51128, imagefill() doesn't work with large images
X-Git-Tag: php-5.3.3RC1~243
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0688e6ef011d9ccf7ff950d4e4ba625ea8960373;p=php

- - Fixed #51128, imagefill() doesn't work with large images
---

diff --git a/NEWS b/NEWS
index 73982130fe..2c54d57167 100644
--- a/NEWS
+++ b/NEWS
@@ -86,6 +86,7 @@ PHP                                                                        NEWS
   (Felipe)
 - Fixed bug #51171 (curl_setopt() doesn't output any errors or warnings when    
   an invalid option is provided). (Ilia)
+- Fixed bug #51128 (imagefill() doesn't work with large images). (Pierre)
 - Fixed bug #51096 ('last day' and 'first day' are handled incorrectly when
   parsing date strings). (Derick)
 - Fixed bug #51086 (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones)
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 0510bec14e..0cc2e1d7de 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1845,9 +1845,9 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 struct seg {int y, xl, xr, dy;};
 
 /* max depth of stack */
-#define FILL_MAX 1200000
+#define FILL_MAX ((int)(im->sy*im->sx)/4)
 #define FILL_PUSH(Y, XL, XR, DY) \
-    if (sp<stack+FILL_MAX*10 && Y+(DY)>=0 && Y+(DY)<wy2) \
+    if (sp<stack+FILL_MAX && Y+(DY)>=0 && Y+(DY)<wy2) \
     {sp->y = Y; sp->xl = XL; sp->xr = XR; sp->dy = DY; sp++;}
 
 #define FILL_POP(Y, XL, XR, DY) \