From: Ilia Alshanetsky <iliaa@php.net>
Date: Fri, 4 Apr 2003 00:16:47 +0000 (+0000)
Subject: Fix segfault in imagecopyresized().
X-Git-Tag: RELEASE_0_5~149
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=925bc0fd7d04ae2ee784b5f2e5932f948f6800a1;p=php

Fix segfault in imagecopyresized().
---

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 605b829de4..d4b771454d 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -2946,6 +2946,11 @@ PHP_FUNCTION(imagecopyresized)
 	dstY = Z_LVAL_PP(DY);
 	dstH = Z_LVAL_PP(DH);
 	dstW = Z_LVAL_PP(DW);
+	
+	if (dstW < 0 || dstH < 0 || srcW < 0 || srcH < 0) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid image dimensions");
+		RETURN_FALSE;
+	}
 
 	gdImageCopyResized(im_dst, im_src, dstX, dstY, srcX, srcY, dstW, dstH, srcW, srcH);
 	RETURN_TRUE;