Skip to content

Commit 0c7250f

Browse files
committed
remove the huge test file, generate it on the fly instead
1 parent fc0b0af commit 0c7250f

File tree

2 files changed

+23
-1
lines changed

2 files changed

+23
-1
lines changed

ext/gd/tests/bug72339.gd

-64 MB
Binary file not shown.

ext/gd/tests/bug72339.phpt

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,29 @@ Bug #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
33
--SKIPIF--
44
<?php if (!function_exists("imagecreatefromgd2")) print "skip"; ?>
55
--FILE--
6-
<?php imagecreatefromgd2(dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug72339.gd"); ?>
6+
<?php
7+
$fname = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug72339.gd";
8+
9+
$fh = fopen($fname, "w");
10+
fwrite($fh, "gd2\x00");
11+
fwrite($fh, pack("n", 2));
12+
fwrite($fh, pack("n", 1));
13+
fwrite($fh, pack("n", 1));
14+
fwrite($fh, pack("n", 0x40));
15+
fwrite($fh, pack("n", 2));
16+
fwrite($fh, pack("n", 0x5AA0)); // Chunks Wide
17+
fwrite($fh, pack("n", 0x5B00)); // Chunks Vertically
18+
fwrite($fh, str_repeat("\x41\x41\x41\x41", 0x1000000)); // overflow data
19+
fclose($fh);
20+
21+
$im = imagecreatefromgd2($fname);
22+
23+
if ($im) {
24+
imagedestroy($im);
25+
}
26+
unlink($fname);
27+
28+
?>
729
--EXPECTF--
830
Warning: imagecreatefromgd2(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
931
in %sbug72339.php on line %d

0 commit comments

Comments
 (0)