From: Takeshi Abe <tabe@php.net>
Date: Sat, 14 Mar 2009 16:08:00 +0000 (+0000)
Subject: MFH: Fixed bug #45799 (imagepng() crashes on empty image)
X-Git-Tag: RELEASE_1_3_5~14
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d2709b764c8bb80d3c25f389bc04171f3d597427;p=php

MFH: Fixed bug #45799 (imagepng() crashes on empty image)
---

diff --git a/NEWS b/NEWS
index 0e4f1681c8..bb2b31f2e6 100644
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,7 @@ PHP                                                                        NEWS
 - Fixed bug #46048 (SimpleXML top-level @attributes not part of iterator).
   (David C.)
 - Fixed bug #45432 (PDO: persistent connection leak). (Felipe)
+- Fixed bug #45799 (imagepng() crashes on empty image). (Martin McNickle, Takeshi Abe)
 - Fixed bug #43831 ($this gets mangled when extending PDO with persistent 
   connection). (Felipe)
 - Fixed PECL Bug #16035 (OCI8: oci_connect without ORACLE_HOME defined causes segfault) (Chris Jones/Oracle Corp.)
diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c
index 506958106c..6b9c81ec99 100644
--- a/ext/gd/libgd/gd_png.c
+++ b/ext/gd/libgd/gd_png.c
@@ -543,6 +543,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
 				++colors;
 			}
 		}
+		if (colors == 0) {
+			php_gd_error("gd-png error: no colors in palette");
+			goto bail;
+		}
 		if (colors < im->colorsTotal) {
 			remap = TRUE;
 		}
@@ -740,6 +744,7 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
 		}
 	}
 	/* 1.6.3: maybe we should give that memory BACK! TBB */
+ bail:
 	png_destroy_write_struct(&png_ptr, &info_ptr);
 }
 
diff --git a/ext/gd/tests/bug45799.phpt b/ext/gd/tests/bug45799.phpt
new file mode 100644
index 0000000000..a28f940b76
--- /dev/null
+++ b/ext/gd/tests/bug45799.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #45799 (imagepng() crashes on empty image).
+--SKIPIF--
+<?php
+	if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$img = imagecreate(500,500);
+imagepng($img);
+imagedestroy($img);
+?>
+--EXPECTF--
+
+Warning: imagepng(): gd-png error: no colors in palette in %s on line %d