CVE-2016-9317: Improper Input Validation (CWE-20)
value: The gdImageCreate function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (system hang) via an oversized image.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.5
Published: 2017-01-26T15:59Z
Repository: https://github.com/libgd/libgd
Language: Other
Files changed: src/gd.c, tests/CMakeLists.txt, tests/Makefile.am, tests/gdimagecreate/.gitignore, tests/gdimagecreate/CMakeLists.txt, tests/gdimagecreate/Makemodule.am, tests/gdimagecreate/bug00340.c
Commit date: 2016-12-13 16:02:19 +0100
Commit message: Fix #340: System frozen

gdImageCreate() doesn't check for oversized images and as such is prone
to DoS vulnerabilities. We fix that by applying the same overflow check
that is already in place for gdImageCreateTrueColor().

CVE-2016-9317

Diff: diff --git a/src/gd.c b/src/gd.c
index f0cfacdc..d5d1a7ec 100644
--- a/src/gd.c
+++ b/src/gd.c
@@ -186,10 +186,11 @@ BGD_DECLARE(gdImagePtr) gdImageCreate (int sx, int sy)
 	gdImagePtr im;
 
 	if (overflow2(sx, sy)) {
 		return NULL;
 	}
+
 	if (overflow2(sizeof (unsigned char *), sy)) {
 		return NULL;
 	}
 	if (overflow2(sizeof (unsigned char), sx)) {
 		return NULL;
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index c4fa9ca9..7eef4bf4 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -36,10 +36,11 @@ if (BUILD_TEST)
 		gdimagecontrast
 		gdimageconvolution
 		gdimagecopy
 		gdimagecopyresampled
 		gdimagecopyrotated
+		gdimagecreate
 		gdimagecrop
 		gdimagefile
 		gdimagefill
 		gdimagefilledarc
 		gdimagefilledellipse
diff --git a/tests/Makefile.am b/tests/Makefile.am
index fc5ed2b0..5f8b624b 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -31,10 +31,11 @@ include gdimagecolortransparent/Makemodule.am
 include gdimagecontrast/Makemodule.am
 include gdimageconvolution/Makemodule.am
 include gdimagecopy/Makemodule.am
 include gdimagecopyresampled/Makemodule.am
 include gdimagecopyrotated/Makemodule.am
+include gdimagecreate/Makemodule.am
 include gdimagecrop/Makemodule.am
 include gdimagefile/Makemodule.am
 include gdimagefill/Makemodule.am
 include gdimagefilledarc/Makemodule.am
 include gdimagefilledellipse/Makemodule.am
diff --git a/tests/gdimagecreate/.gitignore b/tests/gdimagecreate/.gitignore
new file mode 100644
index 00000000..6300aed1
--- /dev/null
+++ b/tests/gdimagecreate/.gitignore
@@ -0,0 +1 @@
+/bug00340
diff --git a/tests/gdimagecreate/CMakeLists.txt b/tests/gdimagecreate/CMakeLists.txt
new file mode 100644
index 00000000..905e79c5
--- /dev/null
+++ b/tests/gdimagecreate/CMakeLists.txt
@@ -0,0 +1,5 @@
+SET(TESTS_FILES
+	bug00340
+)
+
+ADD_GD_TESTS()
diff --git a/tests/gdimagecreate/Makemodule.am b/tests/gdimagecreate/Makemodule.am
new file mode 100644
index 00000000..88660869
--- /dev/null
+++ b/tests/gdimagecreate/Makemodule.am
@@ -0,0 +1,5 @@
+libgd_test_programs += \
+	gdimagecreate/bug00340
+
+EXTRA_DIST += \
+	gdimagecreate/CMakeLists.txt
diff --git a/tests/gdimagecreate/bug00340.c b/tests/gdimagecreate/bug00340.c
new file mode 100644
index 00000000..5babcaab
--- /dev/null
+++ b/tests/gdimagecreate/bug00340.c
@@ -0,0 +1,33 @@
+/**
+ * Regression test for <https://github.com/libgd/libgd/issues/340>
+ *
+ * We're testing that trying to create an oversized image fails early,
+ * triggering an appropriate warning.
+ */
+
+
+#include <string.h>
+#include "gd.h"
+#include "gd_errors.h"
+#include "gdtest.h"
+
+
+#define MSG "product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully\n"
+
+
+void error_handler(int priority, const char *format, ...)
+{
+    gdTestAssert(priority == GD_WARNING);
+    gdTestAssert(!strcmp(format, MSG));
+}
+
+
+int main()
+{
+    gdImagePtr im;
+
+    im = gdImageCreate(64970, 65111);
+    gdTestAssert(im == NULL);
+
+    return gdNumFailures();
+}

Fixed code: 
		gdimagecreate
include gdimagecreate/Makemodule.am
/bug00340
SET(TESTS_FILES
	bug00340
)

ADD_GD_TESTS()
libgd_test_programs += \
	gdimagecreate/bug00340

EXTRA_DIST += \
	gdimagecreate/CMakeLists.txt
/**
 * Regression test for <https://github.com/libgd/libgd/issues/340>
 *
 * We're testing that trying to create an oversized image fails early,
 * triggering an appropriate warning.
 */


#include <string.h>
#include "gd.h"
#include "gd_errors.h"
#include "gdtest.h"


#define MSG "product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully\n"


void error_handler(int priority, const char *format, ...)
{
    gdTestAssert(priority == GD_WARNING);
    gdTestAssert(!strcmp(format, MSG));
}


int main()
{
    gdImagePtr im;

    im = gdImageCreate(64970, 65111);
    gdTestAssert(im == NULL);

    return gdNumFailures();
}