Add extra check for srcW/H

jordikroon · jordikroon · commit 49bcb1e51bbb · 2026-02-09T00:59:17.000+01:00
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
@@ -2361,7 +2361,6 @@ static int _gdValidateCopyRectBounds(
 	return 1;
 }
 
-
 void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX, int srcY, int w, int h)
 {
 	if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, w, h)) {
@@ -2555,6 +2554,10 @@ void gdImageCopyResized (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int
 		return;
 	}
 
+	if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, srcW, srcH)) {
+		return;
+	}
+
 	int c;
 	int x, y;
 	int tox, toy;
@@ -2669,6 +2672,10 @@ void gdImageCopyResampled (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, i
 		return;
 	}
 
+	if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, srcW, srcH)) {
+		return;
+	}
+
 	int x, y;
 	double sy1, sy2, sx1, sx2;
 

Original file line number	Diff line number	Diff line change
`@@ -2361,7 +2361,6 @@ static int _gdValidateCopyRectBounds(`
`2361`	`2361`	`return 1;`
`2362`	`2362`	`}`
`2363`	`2363`
`2364`		`-`
`2365`	`2364`	`void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX, int srcY, int w, int h)`
`2366`	`2365`	`{`
`2367`	`2366`	`if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, w, h)) {`
`@@ -2555,6 +2554,10 @@ void gdImageCopyResized (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int`
`2555`	`2554`	`return;`
`2556`	`2555`	`}`
`2557`	`2556`
	`2557`	`+ if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, srcW, srcH)) {`
	`2558`	`+ return;`
	`2559`	`+ }`
	`2560`	`+`
`2558`	`2561`	`int c;`
`2559`	`2562`	`int x, y;`
`2560`	`2563`	`int tox, toy;`
`@@ -2669,6 +2672,10 @@ void gdImageCopyResampled (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, i`
`2669`	`2672`	`return;`
`2670`	`2673`	`}`
`2671`	`2674`
	`2675`	`+ if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, srcW, srcH)) {`
	`2676`	`+ return;`
	`2677`	`+ }`
	`2678`	`+`
`2672`	`2679`	`int x, y;`
`2673`	`2680`	`double sy1, sy2, sx1, sx2;`
`2674`	`2681`