_gdImageFillTiled reads outside the buffer
Issue #104
new
PHP needed to fix this 6 years ago and only applied it to their fork instead of the underlying library. Please upstream this: https://github.com/php/php-src/commit/7e0ca9e1d7458eb02fc547b0e0735425a0aad352
Issue
#118was marked as a duplicate of this issue.