Add extra check for srcW/H

jordikroon · jordikroon · commit 59a4db5db6a9 · 2026-05-26T21:48:18.000+02:00
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
@@ -2342,7 +2342,6 @@ static int _gdValidateCopyRectBounds(
 	return 1;
 }
 
-
 void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX, int srcY, int w, int h)
 {
 	if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, w, h)) {
@@ -2536,6 +2535,10 @@ void gdImageCopyResized (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int
 		return;
 	}
 
+	if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, srcW, srcH)) {
+		return;
+	}
+
 	int c;
 	int x, y;
 	int tox, toy;
@@ -2650,6 +2653,10 @@ void gdImageCopyResampled (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, i
 		return;
 	}
 
+	if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, srcW, srcH)) {
+		return;
+	}
+
 	int x, y;
 	double sy1, sy2, sx1, sx2;
 

Original file line number	Diff line number	Diff line change
`@@ -2342,7 +2342,6 @@ static int _gdValidateCopyRectBounds(`
`2342`	`2342`	`return 1;`
`2343`	`2343`	`}`
`2344`	`2344`
`2345`		`-`
`2346`	`2345`	`void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX, int srcY, int w, int h)`
`2347`	`2346`	`{`
`2348`	`2347`	`if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, w, h)) {`
`@@ -2536,6 +2535,10 @@ void gdImageCopyResized (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int`
`2536`	`2535`	`return;`
`2537`	`2536`	`}`
`2538`	`2537`
	`2538`	`+ if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, srcW, srcH)) {`
	`2539`	`+ return;`
	`2540`	`+ }`
	`2541`	`+`
`2539`	`2542`	`int c;`
`2540`	`2543`	`int x, y;`
`2541`	`2544`	`int tox, toy;`
`@@ -2650,6 +2653,10 @@ void gdImageCopyResampled (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, i`
`2650`	`2653`	`return;`
`2651`	`2654`	`}`
`2652`	`2655`
	`2656`	`+ if (!_gdValidateCopyRectBounds(dst, src, dstX, dstY, srcX, srcY, srcW, srcH)) {`
	`2657`	`+ return;`
	`2658`	`+ }`
	`2659`	`+`
`2653`	`2660`	`int x, y;`
`2654`	`2661`	`double sy1, sy2, sx1, sx2;`
`2655`	`2662`