From f11d064b6a2b811de9bb8291b605944ee365d5bf Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Sun, 9 May 2004 18:25:33 +0000 Subject: [PATCH] Fixed bug #28304 (Missing bounds check inside imagefilter()). --- ext/gd/libgd/gd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index ff3e60a7d4..c3f3be822d 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -3607,8 +3607,9 @@ int gdImageConvolution(gdImagePtr src, float filter[3][3], float filter_div, flo new_a = gdImageAlpha(srcback, pxl); for (j=0; j<3; j++) { + int yv = MIN(MAX(y - 1 + j, 0), src->sy - 1); for (i=0; i<3; i++) { - pxl = f(srcback, x-(3>>1)+i, y-(3>>1)+j); + pxl = f(srcback, MIN(MAX(x - 1 + i, 0), src->sx - 1), yv); new_r += (float)gdImageRed(srcback, pxl) * filter[j][i]; new_g += (float)gdImageGreen(srcback, pxl) * filter[j][i]; new_b += (float)gdImageBlue(srcback, pxl) * filter[j][i]; -- 2.40.0