iliaa Tue Jun 3 19:42:49 2003 EDT
Modified files: (Branch: PHP_4_3)
/php4/ext/gd/libgd gd_gif_in.c gdxpm.c
Log:
MFH (Last set of integer overflow checks.)
Index: php4/ext/gd/libgd/gd_gif_in.c
diff -u php4/ext/gd/libgd/gd_gif_in.c:1.2.2.1 php4/ext/gd/libgd/gd_gif_in.c:1.2.2.2
--- php4/ext/gd/libgd/gd_gif_in.c:1.2.2.1 Wed Mar 5 11:04:20 2003
+++ php4/ext/gd/libgd/gd_gif_in.c Tue Jun 3 19:42:49 2003
@@ -299,7 +299,7 @@
rv = GetDataBlock_(fd,buf);
if (VERBOSE) {
if (rv > 0) {
- tmp = emalloc((3*sizeof(char)*rv) + 1);
+ tmp = safe_emalloc(3 * rv, sizeof(char), 1);
for (i=0;i<rv;i++) {
sprintf(&tmp[3*sizeof(char)*i], " %02x", buf[i]);
}
Index: php4/ext/gd/libgd/gdxpm.c
diff -u php4/ext/gd/libgd/gdxpm.c:1.2.2.2 php4/ext/gd/libgd/gdxpm.c:1.2.2.3
--- php4/ext/gd/libgd/gdxpm.c:1.2.2.2 Wed Mar 5 11:04:20 2003
+++ php4/ext/gd/libgd/gdxpm.c Tue Jun 3 19:42:49 2003
@@ -37,7 +37,7 @@
return 0;
number = image.ncolors;
- colors = (int *) gdMalloc (sizeof (int) * number);
+ colors = (int *) safe_emalloc(number, sizeof(int), 0);
for (i = 0; i < number; i++)
{
switch (strlen (image.colorTable[i].c_color))
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
