File php-CVE-2019-6977.patch of Package php5.14673

X-Git-Url: http://208.43.231.11:8000/?p=php-src.git;a=blobdiff_plain;f=ext%2Fgd%2Flibgd%2Fgd_color.c;h=e6f539bc75b5520001fbad71fda977d7c5fdd96c;hp=a4e56b1c40157b7f9334967bcd101f63a47f919b;hb=7a12dad4dd6c370835b13afae214b240082c7538;hpb=1cc2182bcc81e185c14837e659d12b268cb99d63

diff --git a/ext/gd/libgd/gd_color.c b/ext/gd/libgd/gd_color.c
index a4e56b1..e6f539b 100644
--- a/ext/gd/libgd/gd_color.c
+++ b/ext/gd/libgd/gd_color.c
@@ -33,8 +33,8 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2)
 		return -4; /* At least 1 color must be allocated */
 	}
 
-	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0);
-	memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal );
+	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * gdMaxColors, 0);
+	memset( buf, 0, sizeof(unsigned long) * 5 * gdMaxColors );
 
 	for (x=0; x<im1->sx; x++) {
 		for( y=0; y<im1->sy; y++ ) {