Commits

Anonymous committed fb40bd6

-MFB #112, gdImageColorDeallocate can write outside buffer

  • Participants
  • Parent commits 9d7c728
  • Branches GD-2.0

Comments (0)

Files changed (4)

 
 BGD_DECLARE(void) gdImageColorDeallocate (gdImagePtr im, int color)
 {
-  if (im->trueColor)
+  if (im->trueColor || (color >= gdMaxColors))
     {
       return;
     }

src/tests/CMakeLists.txt

 		gdimagecolorclosest
 		gdimagecolorexact
 		gdimagecolorresolve
+		gdimagecolordeallocate
 		#gdimageellipse
 		gdimageline
 		gdimagefilledellipse

src/tests/gdimagecolordeallocate/CMakeLists.txt

+SET(TESTS_FILES
+	gdimagecolordeallocate
+)
+
+FOREACH(test_name ${TESTS_FILES})
+	add_executable(${test_name} "${test_name}.c")
+	target_link_libraries (${test_name} gdTest ${GD_LIB})
+	ADD_TEST("${test_name}" ${EXECUTABLE_OUTPUT_PATH}/${test_name})
+ENDFOREACH(test_name)

src/tests/gdimagecolordeallocate/gdimagecolordeallocate.c

+#include <gd.h>
+#include <stdio.h>
+#include "gdtest.h"
+
+int main()
+{
+	gdImagePtr im;
+	int error = 0;
+
+	im = gdImageCreate(1, 1);
+
+	im->open[gdMaxColors] = 0;
+
+	gdImageColorDeallocate(im, gdMaxColors);
+
+	if(im->open[gdMaxColors] == 1) {
+		error = -1;
+	}	
+
+	gdImageDestroy(im);
+
+	return error;
+}