diff options
| -rw-r--r-- | ext/gd/gd.c | 4 | ||||
| -rw-r--r-- | ext/gd/tests/bug38212.phpt | 5 | ||||
| -rw-r--r-- | ext/gd/tests/bug39286.phpt | 14 |
3 files changed, 21 insertions, 2 deletions
diff --git a/ext/gd/gd.c b/ext/gd/gd.c index f3667cbc21..f7786ce817 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -2375,6 +2375,10 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type, if (argc == 5 && image_type == PHP_GDIMG_TYPE_GD2PART) { multi_convert_to_long_ex(4, srcx, srcy, width, height); + if (Z_LVAL_PP(width) < 1 || Z_LVAL_PP(height) < 1) { + php_error_docref(NULL TSRMLS_CC, E_WARNING,"Zero width or height not allowed"); + RETURN_FALSE; + } } fn = Z_STRVAL_PP(file); diff --git a/ext/gd/tests/bug38212.phpt b/ext/gd/tests/bug38212.phpt index 0094712a55..04c89fece4 100644 --- a/ext/gd/tests/bug38212.phpt +++ b/ext/gd/tests/bug38212.phpt @@ -1,5 +1,5 @@ --TEST-- -imagecopy doen't copy alpha, palette to truecolor +Bzg #38212 (Seg Fault on invalid imagecreatefromgd2part() parameters) --SKIPIF-- <?php if (!function_exists('imagecopy')) die("skip gd extension not available\n"); @@ -14,4 +14,5 @@ $im = imagecreatefromgd2part($file, 0,0, -25,10); unlink($file); ?> --EXPECTF-- -Warning: imagecreatefromgd2part(): '%sbug38212.gd2' is not a valid GD2 file in %sbug38212.php on line %d + +Warning: imagecreatefromgd2part(): Zero width or height not allowed in %s on line %d diff --git a/ext/gd/tests/bug39286.phpt b/ext/gd/tests/bug39286.phpt new file mode 100644 index 0000000000..3f2a178125 --- /dev/null +++ b/ext/gd/tests/bug39286.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #39508 (imagefill crashes with small images 3 pixels or less) +--SKIPIF-- +<?php + if (!extension_loaded('gd')) die("skip gd extension not available\n"); + if (!GD_BUNDLED) die('skip external GD libraries always fail'); +?> +--FILE-- +<?php +$img =imagecreatefromgd2part("foo.png",0, 100, 0, 100); +?> +--EXPECTF-- + +Warning: imagecreatefromgd2part(): Zero width or height not allowed in %s on line %d |