[2006-07-25 18:34 UTC] seth at pricepages dot org

Description:
------------
A call to imagecreatefromgd2part() with invalid parameters 
(a negative width) causes it to request a negative sized 
chunk of memory, and therefore crash.

Reproduce code:
---------------
<?php
//Image file provided on request
$im = imagecreatefromgd2part('test.gd2', 0,0, -25,100);
?>

Actual result:
--------------
(gdb) bt
#0  0xffff8660 in ___bzero () at /System/Library/Frameworks/
System.framework/PrivateHeaders/ppc/cpu_capabilities.h:187
#1  0x0223a6b8 in _ecalloc (nmemb=19935848, size=4294967247, 
__zend_filename=0x2345654 "/usr/local/php/php-5.1.4/ext/gd/
libgd/gd.c", __zend_lineno=135, __zend_orig_filename=0x0, 
__zend_orig_lineno=19935848) at /usr/local/php/php-5.1.4/
Zend/zend_alloc.c:325
#2  0x0207691c in php_gd_gdImageCreate (sx=-25, sy=125) at /
usr/local/php/php-5.1.4/ext/gd/libgd/gd.c:135
#3  0x0208178c in php_gd_gdImageCreateFromGd2PartCtx 
(in=0x11fee18, srcx=0, srcy=425, w=-25, h=125) at /usr/
local/php/php-5.1.4/ext/gd/libgd/gd_gd2.c:447
#4  0x02081dfc in php_gd_gdImageCreateFromGd2Part 
(inFile=0x1303268, srcx=0, srcy=425, w=-25, h=125) at /usr/
local/php/php-5.1.4/ext/gd/libgd/gd_gd2.c:405
#5  0x0206c700 in _php_image_create_from (ht=19959208, 
return_value=0x11fd368, return_value_ptr=0xf, this_ptr=0x5, 
return_value_used=0, image_type=10, tn=0x234530c "GD2", 
func_p=0x2081dc0 <php_gd_gdImageCreateFromGd2Part>, 
ioctx_func_p=0x20816f0 <php_gd_gdImageCreateFromGd2PartCtx>) 
at /usr/local/php/php-5.1.4/ext/gd/gd.c:1628
#6  0x0206c80c in zif_imagecreatefromgd2part (ht=19935848, 
return_value=0xffffffcf, return_value_ptr=0xf, this_ptr=0x5, 
return_value_used=0) at /usr/local/php/php-5.1.4/ext/gd/
gd.c:1750
#7  0x02279f94 in zend_do_fcall_common_helper_SPEC 
(execute_data=0xbfffd878) at /usr/local/php/php-5.1.4/Zend/
zend_vm_execute.h:200
#8  0x02279788 in execute (op_array=0x1148c58) at /usr/
local/php/php-5.1.4/Zend/zend_vm_execute.h:92

 [2006-07-26 08:54 UTC] pajoye@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.