File php-CVE-2016-5766.patch of Package php7.16129
Index: php-7.0.7/ext/gd/libgd/gd_gd2.c
===================================================================
--- php-7.0.7.orig/ext/gd/libgd/gd_gd2.c 2016-06-27 17:19:59.919807014 +0200
+++ php-7.0.7/ext/gd/libgd/gd_gd2.c 2016-06-27 17:20:41.192501343 +0200
@@ -138,11 +138,18 @@ static int _gd2GetHeader(gdIOCtxPtr in,
if (gd2_compressed(*fmt)) {
nc = (*ncx) * (*ncy);
GD2_DBG(php_gd_error("Reading %d chunk index entries", nc));
+ if (overflow2(sizeof(t_chunk_info), nc)) {
+ goto fail1;
+ }
sidx = sizeof(t_chunk_info) * nc;
if (sidx <= 0) {
goto fail1;
}
cidx = gdCalloc(sidx, 1);
+ if (cidx == NULL) {
+ goto fail1;
+ }
+
for (i = 0; i < nc; i++) {
if (gdGetInt(&cidx[i].offset, in) != 1) {
gdFree(cidx);