cvs: gd /libgd ISSUES gd.c

pajoye		Thu Jan  4 12:36:40 2007 UTC

  Modified files:              
    /gd/libgd	gd.c ISSUES 
  Log:
  - #14, sanity check for memory alloc error in gdImageCreateTrueColor
  
  
http://cvs.php.net/viewvc.cgi/gd/libgd/gd.c?r1=1.44&r2=1.45&diff_format=u
Index: gd/libgd/gd.c
diff -u gd/libgd/gd.c:1.44 gd/libgd/gd.c:1.45
--- gd/libgd/gd.c:1.44	Wed Jan  3 20:45:58 2007
+++ gd/libgd/gd.c	Thu Jan  4 12:36:40 2007
@@ -1,4 +1,4 @@
-/* $Id: gd.c,v 1.44 2007/01/03 20:45:58 pajoye Exp $ */
+/* $Id: gd.c,v 1.45 2007/01/04 12:36:40 pajoye Exp $ */
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -142,8 +142,18 @@
   int i;
   gdImagePtr im;
   im = (gdImage *) gdMalloc (sizeof (gdImage));
+  if (!im) {
+    return 0;
+  }
   memset (im, 0, sizeof (gdImage));
+  if (overflow2(sizeof (int *), sy)) {
+    return 0;
+  }
   im->tpixels = (int **) gdMalloc (sizeof (int *) * sy);
+  if (!im->tpixels) {
+    free(im);
+    return 0;
+  }
   im->polyInts = 0;
   im->polyAllocated = 0;
   im->brush = 0;
@@ -152,6 +162,17 @@
   for (i = 0; (i < sy); i++)
     {
       im->tpixels[i] = (int *) gdCalloc (sx, sizeof (int));
+      if (!im->tpixels[i]) {
+        /* 2.0.34 */
+        i--;
+        while (i >= 0) {
+          gdFree(im->tpixels[i]);
+          i--;
+        }
+        gdFree(im->tpixels);
+        gdFree(im);
+        return 0;
+      }
     }
   im->sx = sx;
   im->sy = sy;
@@ -2050,7 +2071,7 @@
 	  /* 2.0: much easier when the destination is truecolor. */
 	  /* 2.0.10: needs a transparent-index check that is still valid if
 	   *          * the source is not truecolor. Thanks to Frank Warmerdam.
-	   *                   */
+	   */
 
 	  if (src->trueColor) {
 		  for (y = 0; (y < h); y++) {
@@ -3296,7 +3317,7 @@
 	BLEND_COLOR(t, dr, r, dr);
 	BLEND_COLOR(t, dg, g, dg);
 	BLEND_COLOR(t, db, b, db);
-	im->tpixels[y][x]=gdTrueColorAlpha(dr, dg, db,  gdAlphaOpaque);
+	im->tpixels[y][x] = gdTrueColorAlpha(dr, dg, db,  gdAlphaOpaque);
 }  
 
 static void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
http://cvs.php.net/viewvc.cgi/gd/libgd/ISSUES?r1=1.32&r2=1.33&diff_format=u
Index: gd/libgd/ISSUES
diff -u gd/libgd/ISSUES:1.32 gd/libgd/ISSUES:1.33
--- gd/libgd/ISSUES:1.32	Thu Jan  4 01:49:34 2007
+++ gd/libgd/ISSUES	Thu Jan  4 12:36:40 2007
@@ -32,8 +32,9 @@
      CTX (Takeshi Abe)
 #13, Fixed leak in jinit_2pass_quantizer (gd_topal.c) (Huib-Jan Imbens)
 #14, Added santiy checks for possible memory allocation errors:
-     (John Ellson/Graphviz, Pierre, Phil Knirsch)
+     (John Ellson/Graphviz, Pierre, Phil Knirsch, Phil Knirsch)
  - gdImageCreate 
+ - gdImageCreateTrueColor
  - gdImageFilledPolygon and gdImageSetStyle
  - gdCacheCreate and main
  - fontFetch and tweenColorFetch