From: Stanislav Malyshev <stas@php.net>
Date: Tue, 8 Dec 2015 07:30:49 +0000 (-0800)
Subject: Fix bug #70976: fix boundary check on gdImageRotateInterpolated
X-Git-Tag: php-7.0.3RC1~72^2~3
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=84b8db597ae597abce1977ce64dcf231e71330f9;p=php

Fix bug #70976: fix boundary check on gdImageRotateInterpolated
---

diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c
index f70169dddc..0f874ac4cb 100644
--- a/ext/gd/libgd/gd_interpolation.c
+++ b/ext/gd/libgd/gd_interpolation.c
@@ -2162,7 +2162,7 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in
 {
 	const int angle_rounded = (int)floor(angle * 100);
 
-	if (bgcolor < 0) {
+	if (bgcolor < 0 || bgcolor >= gdMaxColors) {
 		return NULL;
 	}
 
diff --git a/ext/gd/tests/bug70976.phpt b/ext/gd/tests/bug70976.phpt
new file mode 100644
index 0000000000..23af4eedc7
--- /dev/null
+++ b/ext/gd/tests/bug70976.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds)
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+?>
+--FILE--
+<?php
+$img = imagerotate(imagecreate(1,1),45,0x7ffffff9);
+var_dump($img);
+?>
+--EXPECTF--
+bool(false)
\ No newline at end of file