From: Pierre Joye <pajoye@php.net>
Date: Wed, 26 Jul 2006 08:53:30 +0000 (+0000)
Subject: - MFH #38212, Segfault on invalid imagecreatefromgd2part() parameters
X-Git-Tag: php-5.2.0RC2~206
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=206ec1a06b8c65ebfc48306ff69a99b92a32a062;p=php

- MFH #38212, Segfault on invalid imagecreatefromgd2part() parameters
---

diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c
index 1e739179e2..3f24e4a476 100644
--- a/ext/gd/libgd/gd_gd2.c
+++ b/ext/gd/libgd/gd_gd2.c
@@ -430,6 +430,10 @@ gdImagePtr gdImageCreateFromGd2PartCtx (gdIOCtx * in, int srcx, int srcy, int w,
 
 	gdImagePtr im;
 
+	if (w<1 || h <1) {
+		return 0;
+	}
+
 	/* The next few lines are basically copied from gd2CreateFromFile
 	 * we change the file size, so don't want to use the code directly.
 	 * but we do need to know the file size.
diff --git a/ext/gd/tests/bug38212.phpt b/ext/gd/tests/bug38212.phpt
new file mode 100644
index 0000000000..0094712a55
--- /dev/null
+++ b/ext/gd/tests/bug38212.phpt
@@ -0,0 +1,17 @@
+--TEST--
+imagecopy doen't copy alpha, palette to truecolor
+--SKIPIF--
+<?php
+        if (!function_exists('imagecopy')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$file = dirname(__FILE__) . '/bug38212.gd2';
+$im1 = imagecreatetruecolor(10,100);
+imagefill($im1, 0,0, 0xffffff);
+imagegd2($im1, $file);
+$im = imagecreatefromgd2part($file, 0,0, -25,10);
+unlink($file);
+?>
+--EXPECTF--
+Warning: imagecreatefromgd2part(): '%sbug38212.gd2' is not a valid GD2 file in %sbug38212.php on line %d