Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write…

…/read access
php · Jul 4, 2016 · 7b2c226 · 7b2c226
1 parent cab1c3b
commit 7b2c226
Showing 1 changed file with 8 additions and 5 deletions.
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
@@ -599,15 +599,18 @@ void gdImageColorDeallocate (gdImagePtr im, int color)
 
 void gdImageColorTransparent (gdImagePtr im, int color)
 {
+	if (color < 0) {
+		return;
+	}
+
 	if (!im->trueColor) {
+		if((color >= gdMaxColors)) {
+			return;
+		}
 		if (im->transparent != -1) {
 			im->alpha[im->transparent] = gdAlphaOpaque;
 		}
-		if (color > -1 && color < im->colorsTotal && color < gdMaxColors) {
-			im->alpha[color] = gdAlphaTransparent;
-		} else {
-			return;
-		}
+		im->alpha[color] = gdAlphaTransparent;
 	}
 	im->transparent = color;
 }