From 2b85acd861f075371ecb523a0d8c7427fa083190 Mon Sep 17 00:00:00 2001 From: Moriyoshi Koizumi Date: Fri, 4 Apr 2003 09:15:18 +0000 Subject: [PATCH] Sorry, forgot these ones --- TODO_SEGFAULTS | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/TODO_SEGFAULTS b/TODO_SEGFAULTS index c9e46452f2..deba58fefb 100644 --- a/TODO_SEGFAULTS +++ b/TODO_SEGFAULTS @@ -71,15 +71,15 @@ Methodology echo dbase_open | php do_crash.txt -(5) integer overflow inside php_imagepolygon and possible subsequent +(4) integer overflow inside php_imagepolygon and possible subsequent integer overflows inside gdlib's gdImageFilledPolygon(). -(6) integer overflow if the number of elements in the array passed as +(5) integer overflow if the number of elements in the array passed as second argument * sizeof(int) result in an overflow. gdImageSetStyle function called by this php wrapper can die for the same reason. -(7) multiple integer overflows that can occur when trying to allocate a buffer +(6) multiple integer overflows that can occur when trying to allocate a buffer for a new image. Affected functions: gdImageCreateFromJpegCtx readwbmp -- 2.40.0