|
 |
b74969 |
From cf4753691dc55999373d1c576f62ecb298723420 Mon Sep 17 00:00:00 2001
|
|
|
b74969 |
From: Remi Collet <remi@php.net>
|
|
|
b74969 |
Date: Mon, 4 Aug 2014 10:42:39 +0200
|
|
|
b74969 |
Subject: [PATCH] Fixed Bug #66901 php-gd 'c_color' NULL pointer dereference
|
|
|
b74969 |
|
|
|
b74969 |
Upstream https://bitbucket.org/libgd/gd-libgd/commits/463c3bd09bfe8e924e19acad7a2a6af16953a704
|
|
|
b74969 |
|
|
|
b74969 |
Notice: this fix don't manage monochrome/monovisual values
|
|
|
b74969 |
but just fix the security issue CVE-2014-2497
|
|
|
b74969 |
failing when trying to load such an image
|
|
|
b74969 |
---
|
|
|
b74969 |
ext/gd/libgd/gdxpm.c | 7 ++++++-
|
|
|
b74969 |
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
b74969 |
|
|
|
b74969 |
diff --git a/ext/gd/libgd/gdxpm.c b/ext/gd/libgd/gdxpm.c
|
|
|
b74969 |
index 73f86e5..b69414e 100644
|
|
|
b74969 |
--- a/ext/gd/libgd/gdxpm.c
|
|
|
b74969 |
+++ b/ext/gd/libgd/gdxpm.c
|
|
|
b74969 |
@@ -31,12 +31,17 @@ gdImagePtr gdImageCreateFromXpm (char *filename)
|
|
|
b74969 |
if (ret != XpmSuccess) {
|
|
|
b74969 |
return 0;
|
|
|
b74969 |
}
|
|
|
b74969 |
+ number = image.ncolors;
|
|
|
b74969 |
+ for(i = 0; i < number; i++) {
|
|
|
b74969 |
+ if (!image.colorTable[i].c_color) {
|
|
|
b74969 |
+ goto done;
|
|
|
b74969 |
+ }
|
|
|
b74969 |
+ }
|
|
|
b74969 |
|
|
|
b74969 |
if (!(im = gdImageCreate(image.width, image.height))) {
|
|
|
b74969 |
goto done;
|
|
|
b74969 |
}
|
|
|
b74969 |
|
|
|
b74969 |
- number = image.ncolors;
|
|
|
b74969 |
colors = (int *) safe_emalloc(number, sizeof(int), 0);
|
|
|
b74969 |
for (i = 0; i < number; i++) {
|
|
|
b74969 |
switch (strlen (image.colorTable[i].c_color)) {
|
|
|
b74969 |
--
|
|
|
b74969 |
1.9.2
|
|
|
b74969 |
|