diff options
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/gd/libgd/gd.c | 8 | ||||
| -rw-r--r-- | ext/gd/tests/bug28147.phpt | 27 |
2 files changed, 33 insertions, 2 deletions
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index fbf8e69881..d6959b91ae 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -1290,7 +1290,9 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col) inc = (dy * 65536) / dx; while ((x >> 16) < x2) { gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (y >> 8) & 0xFF); - gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF); + if ((y >> 16) + 1 < im->sy) { + gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF); + } x += (1 << 16); y += inc; } @@ -1310,7 +1312,9 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col) inc = (dx * 65536) / dy; while ((y>>16) < y2) { gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (x >> 8) & 0xFF); - gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF); + if ((x >> 16) + 1 < im->sx) { + gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF); + } x += inc; y += (1<<16); } diff --git a/ext/gd/tests/bug28147.phpt b/ext/gd/tests/bug28147.phpt new file mode 100644 index 0000000000..b3551a6393 --- /dev/null +++ b/ext/gd/tests/bug28147.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #28147 (Crash with anti-aliased line) +--SKIPIF-- +<?php + if (!extension_loaded('gd')) die("skip gd extension not available\n"); + if (!GD_BUNDLED) die('skip external GD libraries always fail'); +?> +--FILE-- +<?php +// +// This script will generate a Seg Fault on Linux +// +$im = imagecreatetruecolor(300, 300); +$w = imagecolorallocate($im, 255, 255, 255); +$red = imagecolorallocate($im, 255, 0, 0); + +imagefilledrectangle($im,0,0,299,299,$w); + +imageantialias($im,true); +imageline($im, 299, 299, 0, 299, $red); + +imagedestroy($im); + +echo "Alive\n"; +?> +--EXPECT-- +Alive |