From: Sascha Schumann <sas@php.net>
Date: Thu, 3 Apr 2003 19:18:57 +0000 (+0000)
Subject: Fix segfaults in imagecreate/imagecreatetruecolor
X-Git-Tag: RELEASE_0_5~164
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c2e24238384745c94934f052f5d4e2a9568e2241;p=php

Fix segfaults in imagecreate/imagecreatetruecolor
---

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 1db01779e8..53fc513ea1 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -800,6 +800,12 @@ PHP_FUNCTION(imagecreatetruecolor)
 	convert_to_long_ex(x_size);
 	convert_to_long_ex(y_size);
 
+	if (Z_LVAL_PP(x_size) <= 0
+			|| Z_LVAL_PP(y_size) <= 0) {
+		php_error(E_WARNING, "invalid image dimensions");
+		RETURN_FALSE;
+	}
+	
 	im = gdImageCreateTrueColor(Z_LVAL_PP(x_size), Z_LVAL_PP(y_size));
 
 	ZEND_REGISTER_RESOURCE(return_value, im, le_gd);
@@ -1243,6 +1249,12 @@ PHP_FUNCTION(imagecreate)
 	convert_to_long_ex(x_size);
 	convert_to_long_ex(y_size);
 
+	if (Z_LVAL_PP(x_size) <= 0
+			|| Z_LVAL_PP(y_size) <= 0) {
+		php_error(E_WARNING, "invalid image dimensions");
+		RETURN_FALSE;
+	}
+
 	im = gdImageCreate(Z_LVAL_PP(x_size), Z_LVAL_PP(y_size));
 
 	ZEND_REGISTER_RESOURCE(return_value, im, le_gd);