diff options
Diffstat (limited to 'bug72730.patch')
| -rw-r--r-- | bug72730.patch | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/bug72730.patch b/bug72730.patch new file mode 100644 index 0000000..a23f63d --- /dev/null +++ b/bug72730.patch @@ -0,0 +1,52 @@ +Backported from 5.6.25 by Remi. + +From 229782c0ada4d7e72dba6327cc7dff889ce7d92f Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <stas@php.net> +Date: Wed, 10 Aug 2016 00:14:58 -0700 +Subject: [PATCH] Fix bug #72730 - imagegammacorrect allows arbitrary write + access + +--- + ext/gd/gd.c | 5 +++++ + ext/gd/tests/bug72730.phpt | 15 +++++++++++++++ + 2 files changed, 20 insertions(+) + create mode 100644 ext/gd/tests/bug72730.phpt + +diff --git a/ext/gd/gd.c b/ext/gd/gd.c +index 5c604b7..0fb9604 100644 +--- a/ext/gd/gd.c ++++ b/ext/gd/gd.c +@@ -3036,6 +3036,11 @@ PHP_FUNCTION(imagegammacorrect) + return; + } + ++ if ( input <= 0.0 || output <= 0.0 ) { ++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive"); ++ RETURN_FALSE; ++ } ++ + ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd); + + if (gdImageTrueColor(im)) { +diff --git a/ext/gd/tests/bug72730.phpt b/ext/gd/tests/bug72730.phpt +new file mode 100644 +index 0000000..e7c13cb +--- /dev/null ++++ b/ext/gd/tests/bug72730.phpt +@@ -0,0 +1,15 @@ ++--TEST-- ++Bug #72730: imagegammacorrect allows arbitrary write access ++--SKIPIF-- ++<?php ++if (!function_exists("imagecreatetruecolor")) die("skip"); ++?> ++--FILE-- ++<?php ++$img = imagecreatetruecolor(1, 1); ++imagegammacorrect($img, -1, 1337); ++?> ++DONE ++--EXPECTF-- ++Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d ++DONE +\ No newline at end of file |