Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access

pierrejoye · weltling · commit 7b2c22696ad4 · 2016-07-04T10:35:20.000+02:00
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
@@ -599,15 +599,18 @@ void gdImageColorDeallocate (gdImagePtr im, int color)
 
 void gdImageColorTransparent (gdImagePtr im, int color)
 {
+	if (color < 0) {
+		return;
+	}
+
 	if (!im->trueColor) {
+		if((color >= gdMaxColors)) {
+			return;
+		}
 		if (im->transparent != -1) {
 			im->alpha[im->transparent] = gdAlphaOpaque;
 		}
-		if (color > -1 && color < im->colorsTotal && color < gdMaxColors) {
-			im->alpha[color] = gdAlphaTransparent;
-		} else {
-			return;
-		}
+		im->alpha[color] = gdAlphaTransparent;
 	}
 	im->transparent = color;
 }

Original file line number	Diff line number	Diff line change
`@@ -599,15 +599,18 @@ void gdImageColorDeallocate (gdImagePtr im, int color)`
`599`	`599`
`600`	`600`	`void gdImageColorTransparent (gdImagePtr im, int color)`
`601`	`601`	`{`
	`602`	`+ if (color < 0) {`
	`603`	`+ return;`
	`604`	`+ }`
	`605`	`+`
`602`	`606`	`if (!im->trueColor) {`
	`607`	`+ if((color >= gdMaxColors)) {`
	`608`	`+ return;`
	`609`	`+ }`
`603`	`610`	`if (im->transparent != -1) {`
`604`	`611`	`im->alpha[im->transparent] = gdAlphaOpaque;`
`605`	`612`	`}`
`606`		`- if (color > -1 && color < im->colorsTotal && color < gdMaxColors) {`
`607`		`- im->alpha[color] = gdAlphaTransparent;`
`608`		`- } else {`
`609`		`- return;`
`610`		`- }`
	`613`	`+ im->alpha[color] = gdAlphaTransparent;`
`611`	`614`	`}`
`612`	`615`	`im->transparent = color;`
`613`	`616`	`}`