Skip to content

Commit cf47536

Browse files
committed
Fixed Bug #66901 php-gd 'c_color' NULL pointer dereference
Upstream https://bitbucket.org/libgd/gd-libgd/commits/463c3bd09bfe8e924e19acad7a2a6af16953a704 Notice: this fix don't manage monochrome/monovisual values but just fix the security issue CVE-2014-2497 failing when trying to load such an image
1 parent ae74549 commit cf47536

File tree

1 file changed

+6
-1
lines changed

1 file changed

+6
-1
lines changed

ext/gd/libgd/gdxpm.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,17 @@ gdImagePtr gdImageCreateFromXpm (char *filename)
3131
if (ret != XpmSuccess) {
3232
return 0;
3333
}
34+
number = image.ncolors;
35+
for(i = 0; i < number; i++) {
36+
if (!image.colorTable[i].c_color) {
37+
goto done;
38+
}
39+
}
3440

3541
if (!(im = gdImageCreate(image.width, image.height))) {
3642
goto done;
3743
}
3844

39-
number = image.ncolors;
4045
colors = (int *) safe_emalloc(number, sizeof(int), 0);
4146
for (i = 0; i < number; i++) {
4247
switch (strlen (image.colorTable[i].c_color)) {

0 commit comments

Comments
 (0)