File php-CVE-2016-10168.patch of Package php5.14673

Index: php-5.5.14/ext/gd/libgd/gd_gd2.c
===================================================================
--- php-5.5.14.orig/ext/gd/libgd/gd_gd2.c	2017-08-08 13:20:27.168109781 +0200
+++ php-5.5.14/ext/gd/libgd/gd_gd2.c	2017-08-08 13:20:27.176109911 +0200
@@ -136,6 +136,10 @@ static int _gd2GetHeader(gdIOCtxPtr in,
 	GD2_DBG(php_gd_error("%d Chunks vertically", *ncy));
 
 	if (gd2_compressed(*fmt)) {
+               if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
+                       GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
+                       goto fail1;
+               }
 		nc = (*ncx) * (*ncy);
 		GD2_DBG(php_gd_error("Reading %d chunk index entries", nc));
                if (overflow2(sizeof(t_chunk_info), nc)) {
openSUSE Build Service is sponsored by