From 77ba2483d95ec12a8ec4c12ccd0453827f8d3fb8 Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Mon, 19 Sep 2016 16:49:06 +0200 Subject: [PATCH] Port gdImageSetStyle() overflow check from libgd 2.0.29 --- ext/gd/libgd/gd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index 57c0aeafb1..7a0af8de92 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -2789,6 +2789,9 @@ void gdImageSetStyle (gdImagePtr im, int *style, int noOfPixels) if (im->style) { gdFree(im->style); } + if (overflow2(sizeof (int), noOfPixels)) { + return; + } im->style = (int *) gdMalloc(sizeof(int) * noOfPixels); memcpy(im->style, style, sizeof(int) * noOfPixels); im->styleLength = noOfPixels; -- 2.50.1