From c1b257fc45a3a100eec9e71d5249b1538200bdf5 Mon Sep 17 00:00:00 2001
From: Takeshi Abe <tabe@php.net>
Date: Sat, 14 Mar 2009 16:06:57 +0000
Subject: [PATCH] Fixed bug #45799 (imagepng() crashes on empty image)

---
 ext/gd/libgd/gd_png.c      |  5 +++++
 ext/gd/tests/bug45799.phpt | 15 +++++++++++++++
 2 files changed, 20 insertions(+)
 create mode 100644 ext/gd/tests/bug45799.phpt

diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c
index 773e652247..296f934310 100644
--- a/ext/gd/libgd/gd_png.c
+++ b/ext/gd/libgd/gd_png.c
@@ -544,6 +544,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
 				++colors;
 			}
 		}
+		if (colors == 0) {
+			php_gd_error("gd-png error: no colors in palette");
+			goto bail;
+		}
 		if (colors < im->colorsTotal) {
 			remap = TRUE;
 		}
@@ -741,6 +745,7 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
 		}
 	}
 	/* 1.6.3: maybe we should give that memory BACK! TBB */
+ bail:
 	png_destroy_write_struct(&png_ptr, &info_ptr);
 }
 
diff --git a/ext/gd/tests/bug45799.phpt b/ext/gd/tests/bug45799.phpt
new file mode 100644
index 0000000000..a28f940b76
--- /dev/null
+++ b/ext/gd/tests/bug45799.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #45799 (imagepng() crashes on empty image).
+--SKIPIF--
+<?php
+	if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$img = imagecreate(500,500);
+imagepng($img);
+imagedestroy($img);
+?>
+--EXPECTF--
+
+Warning: imagepng(): gd-png error: no colors in palette in %s on line %d
-- 
2.40.0