cvs: gd(GD_2_0) /libgd NEWS gd.c

pajoye		Sat Jun  9 12:30:11 2007 UTC

  Modified files:              (Branch: GD_2_0)
    /gd/libgd	NEWS gd.c 
  Log:
  - #89, Possible integer overflow in gdImageCreateTrueColor
  
  
http://cvs.php.net/viewvc.cgi/gd/libgd/NEWS?r1=1.4.2.18&r2=1.4.2.19&diff_format=u
Index: gd/libgd/NEWS
diff -u gd/libgd/NEWS:1.4.2.18 gd/libgd/NEWS:1.4.2.19
--- gd/libgd/NEWS:1.4.2.18	Fri Jun  8 05:21:25 2007
+++ gd/libgd/NEWS	Sat Jun  9 12:30:11 2007
@@ -24,6 +24,7 @@
     (Pierre)
 87, Fixed segfault when an invalid color index is present in the image data
     Reported by Elliot <wccode at gmail dot com> (Pierre)
+89, Possible integer overflow in gdImageCreateTrueColor (Pierre)
 
 GD 2.0.34 (2007-02-07)
  3, Initialize variables in tweenColorTest, fix cache
http://cvs.php.net/viewvc.cgi/gd/libgd/gd.c?r1=1.49.2.10&r2=1.49.2.11&diff_format=u
Index: gd/libgd/gd.c
diff -u gd/libgd/gd.c:1.49.2.10 gd/libgd/gd.c:1.49.2.11
--- gd/libgd/gd.c:1.49.2.10	Mon May  7 10:21:57 2007
+++ gd/libgd/gd.c	Sat Jun  9 12:30:11 2007
@@ -1,4 +1,4 @@
-/* $Id: gd.c,v 1.49.2.10 2007/05/07 10:21:57 pajoye Exp $ */
+/* $Id: gd.c,v 1.49.2.11 2007/06/09 12:30:11 pajoye Exp $ */
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -141,14 +141,25 @@
 {
   int i;
   gdImagePtr im;
+
+  if (overflow2(sx, sy)) {
+    return NULL;
+  }
+
+  if (overflow2(sizeof (int *), sy)) {
+    return 0;
+  }
+
+  if (overflow2(sizeof(int), sx)) {
+    return NULL;
+  }
+
   im = (gdImage *) gdMalloc (sizeof (gdImage));
   if (!im) {
     return 0;
   }
   memset (im, 0, sizeof (gdImage));
-  if (overflow2(sizeof (int *), sy)) {
-    return 0;
-  }
+
   im->tpixels = (int **) gdMalloc (sizeof (int *) * sy);
   if (!im->tpixels) {
     gdFree(im);