iliaa Tue Jun 3 19:42:49 2003 EDT Modified files: (Branch: PHP_4_3) /php4/ext/gd/libgd gd_gif_in.c gdxpm.c Log: MFH (Last set of integer overflow checks.) Index: php4/ext/gd/libgd/gd_gif_in.c diff -u php4/ext/gd/libgd/gd_gif_in.c:1.2.2.1 php4/ext/gd/libgd/gd_gif_in.c:1.2.2.2 --- php4/ext/gd/libgd/gd_gif_in.c:1.2.2.1 Wed Mar 5 11:04:20 2003 +++ php4/ext/gd/libgd/gd_gif_in.c Tue Jun 3 19:42:49 2003 @@ -299,7 +299,7 @@ rv = GetDataBlock_(fd,buf); if (VERBOSE) { if (rv > 0) { - tmp = emalloc((3*sizeof(char)*rv) + 1); + tmp = safe_emalloc(3 * rv, sizeof(char), 1); for (i=0;i<rv;i++) { sprintf(&tmp[3*sizeof(char)*i], " %02x", buf[i]); } Index: php4/ext/gd/libgd/gdxpm.c diff -u php4/ext/gd/libgd/gdxpm.c:1.2.2.2 php4/ext/gd/libgd/gdxpm.c:1.2.2.3 --- php4/ext/gd/libgd/gdxpm.c:1.2.2.2 Wed Mar 5 11:04:20 2003 +++ php4/ext/gd/libgd/gdxpm.c Tue Jun 3 19:42:49 2003 @@ -37,7 +37,7 @@ return 0; number = image.ncolors; - colors = (int *) gdMalloc (sizeof (int) * number); + colors = (int *) safe_emalloc(number, sizeof(int), 0); for (i = 0; i < number; i++) { switch (strlen (image.colorTable[i].c_color))
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php