From: Pierre Joye <pajoye@php.net>
Date: Wed, 28 Apr 2010 14:35:42 +0000 (+0000)
Subject: - - Fixed #51128, imagefill() doesn't work with large images
X-Git-Tag: php-5.2.14RC1~39
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7a3d3323b9da8890b7bfb0034c277d482746455e;p=php

- - Fixed #51128, imagefill() doesn't work with large images
---

diff --git a/NEWS b/NEWS
index 1fc1f95390..a52393d738 100644
--- a/NEWS
+++ b/NEWS
@@ -54,6 +54,7 @@ PHP                                                                        NEWS
   (Ilia)
 - Fixed bug #51171 (curl_setopt() doesn't output any errors or warnings when 
   an invalid option is provided). (Ilia)
+- Fixed bug #51128 (imagefill() doesn't work with large images). (Pierre)
 - Fixed bug #51086 (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones)
 - Fixed bug #51062 (DBA DB4 uses mismatched headers and libraries). (Chris Jones)
 - Fixed bug #51023 (filter doesn't detect int overflows with GCC 4.4).
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index f7411e6397..94934f5993 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1938,9 +1938,9 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 struct seg {int y, xl, xr, dy;};
 
 /* max depth of stack */
-#define FILL_MAX 1200000
+#define FILL_MAX ((int)(im->sy*im->sx)/4)
 #define FILL_PUSH(Y, XL, XR, DY) \
-    if (sp<stack+FILL_MAX*10 && Y+(DY)>=0 && Y+(DY)<wy2) \
+    if (sp<stack+FILL_MAX && Y+(DY)>=0 && Y+(DY)<wy2) \
     {sp->y = Y; sp->xl = XL; sp->xr = XR; sp->dy = DY; sp++;}
 
 #define FILL_POP(Y, XL, XR, DY) \