cvs: gd /libgd ISSUES gd.c

pajoye		Wed Jan  3 20:45:58 2007 UTC

  Modified files:              
    /gd/libgd	gd.c ISSUES 
  Log:
  #23,  Added sanity checks  for possible allocation failures in 
        gdImageFilledPolygon and gdImageSetStyle
  #24,  Out of range checks in gdImageSetAAPixelColor
  
  
http://cvs.php.net/viewvc.cgi/gd/libgd/gd.c?r1=1.43&r2=1.44&diff_format=u
Index: gd/libgd/gd.c
diff -u gd/libgd/gd.c:1.43 gd/libgd/gd.c:1.44
--- gd/libgd/gd.c:1.43	Wed Jan  3 20:38:53 2007
+++ gd/libgd/gd.c	Wed Jan  3 20:45:58 2007
@@ -1,4 +1,4 @@
-/* $Id: gd.c,v 1.43 2007/01/03 20:38:53 pajoye Exp $ */
+/* $Id: gd.c,v 1.44 2007/01/03 20:45:58 pajoye Exp $ */
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -2819,6 +2819,9 @@
         return;
       }
       im->polyInts = (int *) gdMalloc (sizeof (int) * n);
+			if (!im->polyInts) {
+				return;
+			}
       im->polyAllocated = n;
     }
   if (im->polyAllocated < n)
@@ -2832,6 +2835,9 @@
       }
       im->polyInts = (int *) gdRealloc (im->polyInts,
 					sizeof (int) * im->polyAllocated);
+			if (!im->polyInts) {
+				return;
+			}
     }
   miny = p[0].y;
   maxy = p[0].y;
@@ -2986,6 +2992,9 @@
     return;
   }   	
   im->style = (int *) gdMalloc (sizeof (int) * noOfPixels);
+	if (!im->style) {
+		return;
+	}
   memcpy (im->style, style, sizeof (int) * noOfPixels);
   im->styleLength = noOfPixels;
   im->stylePos = 0;
@@ -3262,6 +3271,11 @@
 static void gdImageSetAAPixelColor(gdImagePtr im, int x, int y, int color, int t)
 {
 	int dr,dg,db,p,r,g,b;
+
+	/* 2.0.34: watch out for out of range calls */
+	if (!gdImageBoundsSafeMacro(im, x, y)) {
+		return;
+	}
 	p = gdImageGetPixel(im,x,y);
         /* TBB: we have to implement the dont_blend stuff to provide
           the full feature set of the old implementation */
http://cvs.php.net/viewvc.cgi/gd/libgd/ISSUES?r1=1.21&r2=1.22&diff_format=u
Index: gd/libgd/ISSUES
diff -u gd/libgd/ISSUES:1.21 gd/libgd/ISSUES:1.22
--- gd/libgd/ISSUES:1.21	Wed Jan  3 20:34:50 2007
+++ gd/libgd/ISSUES	Wed Jan  3 20:45:58 2007
@@ -44,3 +44,6 @@
 #20, Fixed gdImageCopyMergeGray when used with a true color image
 #21, gdImageCopyResized sanity check for allocation failures
 #22, Fixed transparency preservation in gdImageCopyRotated 
+#23,  Added sanity checks  for possible allocation failures in 
+      gdImageFilledPolygon and gdImageSetStyle
+#24,  Out of range checks in gdImageSetAAPixelColor