From 66cd47d5e91fb45adf41ea9ad6f444738d894aec Mon Sep 17 00:00:00 2001
From: Pierre Joye <pajoye@php.net>
Date: Thu, 28 Sep 2006 08:52:23 +0000
Subject: [PATCH] - MFB: imagefill(), infinite loop with wrong color index

---
 ext/gd/libgd/gd.c             |  4 ++++
 ext/gd/tests/imagefill_1.phpt | 25 +++++++++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 ext/gd/tests/imagefill_1.phpt

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 5f2d36f68f..14dcc110c7 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1914,6 +1914,10 @@ void gdImageFill(gdImagePtr im, int x, int y, int nc)
 	struct seg *stack;
 	struct seg *sp;
 
+	if (!im->trueColor && nc > (im->colorsTotal -1)) {
+		return;
+	}
+
 	alphablending_bak = im->alphaBlendingFlag;	
 	im->alphaBlendingFlag = 0;
 
diff --git a/ext/gd/tests/imagefill_1.phpt b/ext/gd/tests/imagefill_1.phpt
new file mode 100644
index 0000000000..04e1cab55a
--- /dev/null
+++ b/ext/gd/tests/imagefill_1.phpt
@@ -0,0 +1,25 @@
+--TEST--
+imagefill() infinite loop with wrong color index
+--SKIPIF--
+<?php 
+	if (!extension_loaded('gd')) {
+		die("skip gd extension not available.");
+	}
+	if (!function_exists("imagefttext")) {
+		die("skip imagefttext() not available.");
+	}
+?>
+--FILE--
+<?php
+$im = imagecreate(100,100);
+$white = imagecolorallocate($im, 255,255,255);
+$blue = imagecolorallocate($im, 0,0,255);
+$green = imagecolorallocate($im, 0,255,0);
+
+print_r(imagecolorat($im, 0,0));
+imagefill($im, 0,0,$white + 3);
+print_r(imagecolorat($im, 0,0));
+imagedestroy($im);
+?>
+--EXPECT--
+00
-- 
2.50.1