cvs: gd(GD_2_0) /libgd NEWS gd.c

mattias		Wed Aug  8 12:57:46 2007 UTC

  Modified files:              (Branch: GD_2_0)
    /gd/libgd	gd.c NEWS 
  Log:
  -MFH: #109, Possible integer overflow in gdImageFill()
  
http://cvs.php.net/viewvc.cgi/gd/libgd/gd.c?r1=1.49.2.16&r2=1.49.2.17&diff_format=u
Index: gd/libgd/gd.c
diff -u gd/libgd/gd.c:1.49.2.16 gd/libgd/gd.c:1.49.2.17
--- gd/libgd/gd.c:1.49.2.16	Tue Jun 19 20:25:51 2007
+++ gd/libgd/gd.c	Wed Aug  8 12:57:46 2007
@@ -1,4 +1,4 @@
-/* $Id: gd.c,v 1.49.2.16 2007/06/19 20:25:51 pajoye Exp $ */
+/* $Id: gd.c,v 1.49.2.17 2007/08/08 12:57:46 mattias Exp $ */
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -1955,6 +1955,14 @@
 		goto done;
 	}
 
+	if(overflow2(im->sy, im->sx)) {
+		return;
+	}
+
+	if(overflow2(sizeof(struct seg), ((im->sy * im->sx) / 4))) {
+		return;
+	}
+
 	stack = (struct seg *)gdMalloc(sizeof(struct seg) * ((int)(im->sy*im->sx)/4));
 	if (!stack) {
 		return;
@@ -2020,6 +2028,14 @@
 	wx2=im->sx;wy2=im->sy;
 	tiled = nc==gdTiled;
 
+	if(overflow2(im->sy, im->sx)) {
+		return;
+	}
+
+	if(overflow2(sizeof(struct seg), ((im->sy * im->sx) / 4))) {
+		return;
+	}
+
 	nc =  gdImageTileGet(im,x,y);
 	pts = (int **) gdCalloc(sizeof(int *) * im->sy, sizeof(int));
 	if (!pts) {
http://cvs.php.net/viewvc.cgi/gd/libgd/NEWS?r1=1.4.2.28&r2=1.4.2.29&diff_format=u
Index: gd/libgd/NEWS
diff -u gd/libgd/NEWS:1.4.2.28 gd/libgd/NEWS:1.4.2.29
--- gd/libgd/NEWS:1.4.2.28	Tue Aug  7 19:50:39 2007
+++ gd/libgd/NEWS	Wed Aug  8 12:57:46 2007
@@ -5,6 +5,7 @@
  97, ease the creation of regexps to match symbols/functions
 101, _gdCreateFromFile() can crash if gdImageCreate fails (Mattias Bengtsson)
 105, gdImageCreateFrom*Ptr() can crash if gdNewDynamicCtxEx() fails (Mattias)
+109, Possible integer overflow in gdImageFill() (Mattias Bengtsson)
 
 GD 2.0.35 (2007-06-21)
 41, Fix valgrind error in gdImageFillTiled (Nuno Lopes)