From: Takeshi Abe Date: Sat, 14 Mar 2009 17:48:42 +0000 (+0000) Subject: MFH: Fixed bug #45799 (imagepng() crashes on empty image) X-Git-Tag: php-5.2.10RC1~298 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7dcb90d877752231eecac388ab8ef1252f104ff7;p=php MFH: Fixed bug #45799 (imagepng() crashes on empty image) --- diff --git a/NEWS b/NEWS index 1f22574997..4975943ec4 100644 --- a/NEWS +++ b/NEWS @@ -15,6 +15,8 @@ PHP NEWS addresses in the filter extension). (Ilia) - Fixed bug #47430 (Errors after writing to nodeValue parameter of an absent previousSibling). (Rob) +- Fixed bug #45799 (imagepng() crashes on empty image). (Martin McNickle, + Takeshi Abe) 26 Feb 2009, PHP 5.2.9 - Changed __call() to be invoked on private/protected method access, similar to diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c index 7591dc0c67..bb53e0d88c 100644 --- a/ext/gd/libgd/gd_png.c +++ b/ext/gd/libgd/gd_png.c @@ -535,6 +535,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte ++colors; } } + if (colors == 0) { + php_gd_error("gd-png error: no colors in palette"); + goto bail; + } if (colors < im->colorsTotal) { remap = TRUE; } @@ -732,6 +736,7 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte } } /* 1.6.3: maybe we should give that memory BACK! TBB */ + bail: png_destroy_write_struct(&png_ptr, &info_ptr); } diff --git a/ext/gd/tests/bug45799.phpt b/ext/gd/tests/bug45799.phpt new file mode 100644 index 0000000000..a28f940b76 --- /dev/null +++ b/ext/gd/tests/bug45799.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #45799 (imagepng() crashes on empty image). +--SKIPIF-- + +--FILE-- + +--EXPECTF-- + +Warning: imagepng(): gd-png error: no colors in palette in %s on line %d