From: Antony Dovgal <tony2001@php.net>
Date: Wed, 26 Oct 2005 21:38:20 +0000 (+0000)
Subject: MFH: fix #34996 (ImageTrueColorToPalette() crashes when ncolors is zero)
X-Git-Tag: php-5.1.0RC4~20
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5b502880b652f1bbabf34a8ac31d8a62f59ddc8a;p=php

MFH: fix #34996 (ImageTrueColorToPalette() crashes when ncolors is zero)
---

diff --git a/NEWS b/NEWS
index 7186bb4677..8098fe181e 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Oct 2005, PHP 5.1 Release Candidate 4
 - Fixed fgetcsv() and fputcsv() inconsistency. (Dmitry)
+- Fixed bug #34996 (ImageTrueColorToPalette() crashes when ncolors is 
+  zero). (Tony)
 - Fixed bug #34977 (Compile failure on MacOSX due to use of varargs.h). (Tony)
 - Fixed bug #34968 (bz2 extension fails on to build on some win32 setups).
   (Ilia)
diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 0b8a2cc7d9..66ce0b2d5a 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -890,6 +890,10 @@ PHP_FUNCTION(imagetruecolortopalette)
 	convert_to_boolean_ex(dither);
 	convert_to_long_ex(ncolors);
 
+	if (Z_LVAL_PP(ncolors) <= 0) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of colors has to be greater than zero");
+		RETURN_FALSE;
+	}
 	gdImageTrueColorToPalette(im, Z_LVAL_PP(dither), Z_LVAL_PP(ncolors));
 
 	RETURN_TRUE;