File php-CVE-2016-10168.patch of Package php7.4025
Index: php-7.0.7/ext/gd/libgd/gd_gd2.c
===================================================================
--- php-7.0.7.orig/ext/gd/libgd/gd_gd2.c 2017-01-31 15:30:53.171046679 +0100
+++ php-7.0.7/ext/gd/libgd/gd_gd2.c 2017-01-31 15:30:53.183046846 +0100
@@ -136,6 +136,10 @@ static int _gd2GetHeader(gdIOCtxPtr in,
GD2_DBG(php_gd_error("%d Chunks vertically", *ncy));
if (gd2_compressed(*fmt)) {
+ if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
+ GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
+ goto fail1;
+ }
nc = (*ncx) * (*ncy);
GD2_DBG(php_gd_error("Reading %d chunk index entries", nc));
if (overflow2(sidx, nc)) {