diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-08-24 17:32:06 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-08-24 17:35:04 +0200 |
| commit | 74de17f2ea9c7485701ada23fa935f9800b5b275 (patch) | |
| tree | e90aebea6347961172f3f9021ae7e23b35c869b0 | |
| parent | 844a2dd6ac9e411e4f24d3a0beab9a23e820325c (diff) | |
| download | php-git-74de17f2ea9c7485701ada23fa935f9800b5b275.tar.gz | |
Fix potential integer overflow detected by oss-fuzz
We port the respective fix from upstream[1].
[1] <https://github.com/libgd/libgd/commit/9ed642764cf0b4585d135eb738812a43265cb2d3>
| -rw-r--r-- | ext/gd/libgd/gd.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index 3e3b359666..29ad19aa34 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -1463,6 +1463,8 @@ void gdImageChar (gdImagePtr im, gdFontPtr f, int x, int y, int c, int color) int cx, cy; int px, py; int fline; + const int xuppper = (x > INT_MAX - f->w) ? INT_MAX : x + f->w; + const int yuppper = (y > INT_MAX - f->h) ? INT_MAX : y + f->h; cx = 0; cy = 0; #ifdef CHARSET_EBCDIC @@ -1472,8 +1474,8 @@ void gdImageChar (gdImagePtr im, gdFontPtr f, int x, int y, int c, int color) return; } fline = (c - f->offset) * f->h * f->w; - for (py = y; (py < (y + f->h)); py++) { - for (px = x; (px < (x + f->w)); px++) { + for (py = y; py < yuppper; py++) { + for (px = x; px < xuppper; px++) { if (f->data[fline + cy * f->w + cx]) { gdImageSetPixel(im, px, py, color); } @@ -1489,6 +1491,8 @@ void gdImageCharUp (gdImagePtr im, gdFontPtr f, int x, int y, int c, int color) int cx, cy; int px, py; int fline; + const int xuppper = (x > INT_MAX - f->h) ? INT_MAX : x + f->h; + const int ylower = (y < INT_MIN + f->w) ? INT_MIN : y - f->w; cx = 0; cy = 0; #ifdef CHARSET_EBCDIC @@ -1498,8 +1502,8 @@ void gdImageCharUp (gdImagePtr im, gdFontPtr f, int x, int y, int c, int color) return; } fline = (c - f->offset) * f->h * f->w; - for (py = y; py > (y - f->w); py--) { - for (px = x; px < (x + f->h); px++) { + for (py = y; py > ylower; py--) { + for (px = x; px < xuppper; px++) { if (f->data[fline + cy * f->w + cx]) { gdImageSetPixel(im, px, py, color); } |