cvs: gd /libgd gd.c

pajoye		Sat Jun  9 12:32:25 2007 UTC

  Modified files:              
    /gd/libgd	gd.c 
  Log:
  - #89, Possible integer overflow in gdImageCreateTrueColor
  
  
http://cvs.php.net/viewvc.cgi/gd/libgd/gd.c?r1=1.57&r2=1.58&diff_format=u
Index: gd/libgd/gd.c
diff -u gd/libgd/gd.c:1.57 gd/libgd/gd.c:1.58
--- gd/libgd/gd.c:1.57	Mon May  7 10:26:44 2007
+++ gd/libgd/gd.c	Sat Jun  9 12:32:25 2007
@@ -1,4 +1,4 @@
-/* $Id: gd.c,v 1.57 2007/05/07 10:26:44 pajoye Exp $ */
+/* $Id: gd.c,v 1.58 2007/06/09 12:32:25 pajoye Exp $ */
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -141,14 +141,25 @@
 {
   int i;
   gdImagePtr im;
+
+  if (overflow2(sx, sy)) {
+    return NULL;
+  }
+
+  if (overflow2(sizeof (int *), sy)) {
+    return 0;
+  }
+
+  if (overflow2(sizeof(int), sx)) {
+    return NULL;
+  }
+
   im = (gdImage *) gdMalloc (sizeof (gdImage));
   if (!im) {
     return 0;
   }
   memset (im, 0, sizeof (gdImage));
-  if (overflow2(sizeof (int *), sy)) {
-    return 0;
-  }
+
   im->tpixels = (int **) gdMalloc (sizeof (int *) * sy);
   if (!im->tpixels) {
     gdFree(im);