Fix Bug #68713 infinite loop / infinite free

remicollet · remicollet · commit df4aaa81ef5a · 2015-01-03T08:34:27.000+01:00
PHP not affected (emalloc never return NULL) Just to reduce diff with upstream and for legibility Apply: https://bitbucket.org/libgd/gd-libgd/commits/3c0d2203b2672b688d4d2326ff3a60b019879062 https://bitbucket.org/libgd/gd-libgd/commits/4af76c97a478d4e7c4b64e08ac67abbca7cbd0fb
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
@@ -3049,8 +3049,8 @@ int gdImagePaletteToTrueColor(gdImagePtr src)
 		}
 	}
 
-	/* free old palette buffer */
-	for (yy = y - 1; yy >= yy - 1; yy--) {
+	/* free old palette buffer (y is sy) */
+	for (yy = 0; yy < y; yy++) {
 		gdFree(src->pixels[yy]);
 	}
 	gdFree(src->pixels);
@@ -3067,13 +3067,11 @@ int gdImagePaletteToTrueColor(gdImagePtr src)
 	return 1;
 
 clean_on_error:
-	if (y > 0) {
-
-		for (yy = y; yy >= yy - 1; y--) {
-			gdFree(src->tpixels[y]);
-		}
-		gdFree(src->tpixels);
+	/* free new true color buffer (y is not allocated, have failed) */
+	for (yy = 0; yy < y; yy++) {
+		gdFree(src->tpixels[yy]);
 	}
+	gdFree(src->tpixels);
 	return 0;
 }
 

Original file line number	Diff line number	Diff line change
`@@ -3049,8 +3049,8 @@ int gdImagePaletteToTrueColor(gdImagePtr src)`
`3049`	`3049`	`}`
`3050`	`3050`	`}`
`3051`	`3051`
`3052`		`- /* free old palette buffer */`
`3053`		`- for (yy = y - 1; yy >= yy - 1; yy--) {`
	`3052`	`+ /* free old palette buffer (y is sy) */`
	`3053`	`+ for (yy = 0; yy < y; yy++) {`
`3054`	`3054`	`gdFree(src->pixels[yy]);`
`3055`	`3055`	`}`
`3056`	`3056`	`gdFree(src->pixels);`
`@@ -3067,13 +3067,11 @@ int gdImagePaletteToTrueColor(gdImagePtr src)`
`3067`	`3067`	`return 1;`
`3068`	`3068`
`3069`	`3069`	`clean_on_error:`
`3070`		`- if (y > 0) {`
`3071`		`-`
`3072`		`- for (yy = y; yy >= yy - 1; y--) {`
`3073`		`- gdFree(src->tpixels[y]);`
`3074`		`- }`
`3075`		`- gdFree(src->tpixels);`
	`3070`	`+ /* free new true color buffer (y is not allocated, have failed) */`
	`3071`	`+ for (yy = 0; yy < y; yy++) {`
	`3072`	`+ gdFree(src->tpixels[yy]);`
`3076`	`3073`	`}`
	`3074`	`+ gdFree(src->tpixels);`
`3077`	`3075`	`return 0;`
`3078`	`3076`	`}`
`3079`	`3077`