1 files changed, 32 insertions, 20 deletions

diff --git a/ext/gd/libgd/gd_crop.c b/ext/gd/libgd/gd_crop.c
index f0b888a4f1..90a99a650a 100644
--- a/ext/gd/libgd/gd_crop.c
+++ b/ext/gd/libgd/gd_crop.c
@@ -44,6 +44,12 @@ gdImagePtr gdImageCrop(gdImagePtr src, const gdRectPtr crop)
 {
 	gdImagePtr dst;
 
+	/* check size */
+	if (crop->width<=0 || crop->height<=0) {
+		return NULL;
+	}
+
+	/* allocate the requested size (could be only partially filled) */
 	if (src->trueColor) {
 		dst = gdImageCreateTrueColor(crop->width, crop->height);
 		gdImageSaveAlpha(dst, 1);
@@ -51,37 +57,43 @@ gdImagePtr gdImageCrop(gdImagePtr src, const gdRectPtr crop)
 		dst = gdImageCreate(crop->width, crop->height);
 		gdImagePaletteCopy(dst, src);
 	}
+	if (dst == NULL) {
+		return NULL;
+	}
 	dst->transparent = src->transparent;
 
-	if (src->sx < (crop->x + crop->width -1)) {
-		crop->width = src->sx - crop->x + 1;
+	/* check position in the src image */
+	if (crop->x < 0 || crop->x>=src->sx || crop->y<0 || crop->y>=src->sy) {
+		return dst;
+	}
+
+	/* reduce size if needed */
+	if ((src->sx - crop->width) < crop->x) {
+		crop->width = src->sx - crop->x;
 	}
-	if (src->sy < (crop->y + crop->height -1)) {
-		crop->height = src->sy - crop->y + 1;
+	if ((src->sy - crop->height) < crop->y) {
+		crop->height = src->sy - crop->y;
 	}
+
 #if 0
 printf("rect->x: %i\nrect->y: %i\nrect->width: %i\nrect->height: %i\n", crop->x, crop->y, crop->width, crop->height);
 #endif
-	if (dst == NULL) {
-		return NULL;
+	int y = crop->y;
+	if (src->trueColor) {
+		unsigned int dst_y = 0;
+		while (y < (crop->y + (crop->height - 1))) {
+			/* TODO: replace 4 w/byte per channel||pitch once available */
+			memcpy(dst->tpixels[dst_y++], src->tpixels[y++] + crop->x, crop->width * 4);
+		}
 	} else {
-		int y = crop->y;
-		if (src->trueColor) {
-			unsigned int dst_y = 0;
-			while (y < (crop->y + (crop->height - 1))) {
-				/* TODO: replace 4 w/byte per channel||pitch once available */
-				memcpy(dst->tpixels[dst_y++], src->tpixels[y++] + crop->x, crop->width * 4);
-			}
-		} else {
-			int x;
-			for (y = crop->y; y < (crop->y + (crop->height - 1)); y++) {
-				for (x = crop->x; x < (crop->x + (crop->width - 1)); x++) {
-					dst->pixels[y - crop->y][x - crop->x] = src->pixels[y][x];
-				}
+		int x;
+		for (y = crop->y; y < (crop->y + (crop->height - 1)); y++) {
+			for (x = crop->x; x < (crop->x + (crop->width - 1)); x++) {
+				dst->pixels[y - crop->y][x - crop->x] = src->pixels[y][x];
 			}
 		}
-		return dst;
 	}
+	return dst;
 }
 
 /**