Skip to content

Fix GH-17772: imagepalettetotruecolor segfault on invalid truecolor p… - #17777

Closed
devnexen wants to merge 1 commit into
php:PHP-8.3from
devnexen:gh17772
Closed

devnexen wants to merge 1 commit into
php:PHP-8.3from
devnexen:gh17772

Conversation

@devnexen

Copy link
Copy Markdown
Member

…ixel.

@devnexen
devnexen marked this pull request as ready for review February 13, 2025 12:04
@cmb69

cmb69 commented Feb 13, 2025 •

Copy link
Copy Markdown
Member

Ugh, that's ugly, since it only affects bundled libgd which uses ZendMM; there appear to be no issues with external libgd (which doesn't heed memory_limit anyway). So it's not likely that we can have a fix being applied upstream, but further down the road some sync might get rid of our fix (should probably add a comment, that gdCalloc() needs to stay).

Possibly even worse, if upstream ever implements custom allocators (libgd/libgd#335), in which case such issues (I expect more than this particular one) would also affect them.

The general problem I'm seeing here is that libgd never came around to actually implement a contiguous buffer for the pixels (although that is planned for many, many years), so you would have a single allocation upfront, instead of allocating an individual buffer for each row.

Comment thread ext/gd/tests/gh17772.phpt Outdated

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since that will only happen with bundled libgd, the test should be skipped if !GD_BUNDLED.

@devnexen devnexen linked an issue Feb 13, 2025 that may be closed by this pull request

@cmb69 cmb69 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Besides the nits below, this looks good to me.

Comment thread ext/gd/libgd/gd.c Outdated

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a comment that this is an intended change, so it won't be inadvertently dropped when syncing with upstream.

Comment thread ext/gd/tests/gh17772.phpt Outdated

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that trailing \n is superfluous at best.

Suggested change
if (!GD_BUNDLED) die("skip requires bundled GD library\n");
if (!GD_BUNDLED) die("skip requires bundled GD library");

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SEGV Zend/zend_alloc.c

2 participants