cvs: gd /libgd gd.c

mattias		Wed Aug  8 12:57:18 2007 UTC

  Modified files:              
    /gd/libgd	gd.c 
  Log:
  - #109, Possible integer overflow in gdImageFill()
  
http://cvs.php.net/viewvc.cgi/gd/libgd/gd.c?r1=1.63&r2=1.64&diff_format=u
Index: gd/libgd/gd.c
diff -u gd/libgd/gd.c:1.63 gd/libgd/gd.c:1.64
--- gd/libgd/gd.c:1.63	Tue Jun 19 20:25:32 2007
+++ gd/libgd/gd.c	Wed Aug  8 12:57:18 2007
@@ -1,4 +1,4 @@
-/* $Id: gd.c,v 1.63 2007/06/19 20:25:32 pajoye Exp $ */
+/* $Id: gd.c,v 1.64 2007/08/08 12:57:18 mattias Exp $ */
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -1954,6 +1954,14 @@
 		goto done;
 	}
 
+	if(overflow2(im->sy, im->sx)) {
+		return;
+	}
+
+	if(overflow2(sizeof(struct seg), ((im->sy * im->sx) / 4))) {
+		return;
+	}
+
 	stack = (struct seg *)gdMalloc(sizeof(struct seg) * ((int)(im->sy*im->sx)/4));
 	if (!stack) {
 		return;
@@ -2019,6 +2027,14 @@
 	wx2=im->sx;wy2=im->sy;
 	tiled = nc==gdTiled;
 
+	if(overflow2(im->sy, im->sx)) {
+		return;
+	}
+
+	if(overflow2(sizeof(struct seg), ((im->sy * im->sx) / 4))) {
+		return;
+	}
+
 	nc =  gdImageTileGet(im,x,y);
 	pts = (char *) gdCalloc(im->sy * im->sx, sizeof(char));
 	if (!pts) {