iliaa Sun Mar 21 13:03:35 2004 EDT
Modified files:
/php-src/ext/gd/libgd gd.c
Log:
Fixed a possible crash inside libgd's gdImageFillToBorder() due to a stack
overflow.
http://cvs.php.net/diff.php/php-src/ext/gd/libgd/gd.c?r1=1.74&r2=1.75&ty=u
Index: php-src/ext/gd/libgd/gd.c
diff -u php-src/ext/gd/libgd/gd.c:1.74 php-src/ext/gd/libgd/gd.c:1.75
--- php-src/ext/gd/libgd/gd.c:1.74 Wed Mar 17 12:07:31 2004
+++ php-src/ext/gd/libgd/gd.c Sun Mar 21 13:02:19 2004
@@ -1757,10 +1757,7 @@
void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
{
- int lastBorder;
- /* Seek left */
- int leftLimit = -1, rightLimit;
- int i, restoreAlphaBleding=0;
+ int i, j, restoreAlphaBleding = 0;
if (border < 0) {
/* Refuse to fill to a non-solid border */
@@ -1779,61 +1776,16 @@
y = im->sy - 1;
}
- for (i = x; i >= 0; i--) {
- if (gdImageGetPixel(im, i, y) == border) {
- break;
- }
- gdImageSetPixel(im, i, y, color);
- leftLimit = i;
- }
- if (leftLimit == -1) {
- if (restoreAlphaBleding) {
- im->alphaBlendingFlag = 1;
- }
- return;
- }
- /* Seek right */
- rightLimit = x;
- for (i = (x + 1); i < im->sx; i++) {
- if (gdImageGetPixel(im, i, y) == border) {
- break;
- }
- gdImageSetPixel(im, i, y, color);
- rightLimit = i;
- }
- /* Look at lines above and below and start paints */
- /* Above */
- if (y > 0) {
- lastBorder = 1;
- for (i = leftLimit; i <= rightLimit; i++) {
- int c = gdImageGetPixel(im, i, y - 1);
- if (lastBorder) {
- if ((c != border) && (c != color)) {
- gdImageFillToBorder(im, i, y - 1, border,
color);
- lastBorder = 0;
- }
- } else if ((c == border) || (c == color)) {
- lastBorder = 1;
+ for (i = x; i < im->sx; i++) {
+ for (j = y; j < im->sy; j++) {
+ int c = gdImageGetPixel(im, i, j);
+ if (c == border || c == color) {
+ continue;
}
+ gdImageSetPixel(im, i, j, color);
}
}
- /* Below */
- if (y < ((im->sy) - 1)) {
- lastBorder = 1;
- for (i = leftLimit; i <= rightLimit; i++) {
- int c = gdImageGetPixel(im, i, y + 1);
-
- if (lastBorder) {
- if ((c != border) && (c != color)) {
- gdImageFillToBorder(im, i, y + 1, border,
color);
- lastBorder = 0;
- }
- } else if ((c == border) || (c == color)) {
- lastBorder = 1;
- }
- }
- }
if (restoreAlphaBleding) {
im->alphaBlendingFlag = 1;
}
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
