hitoshura25/cvefixes huggingface dataset:
CVE-2016-7129 (C, published 2016-09-12T01:59Z)
Description: value: The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/php/php-src
Files changed:
ext/wddx/tests/bug72749.phpt
ext/wddx/wddx.c
Commit message: Fix bug #72749: wddx_deserialize allows illegal memory access


Vulnerable code:
				tmp = emalloc(len + 1);
				memcpy(tmp, s, len);
					Z_TYPE_P(ent->data) = IS_STRING;
					Z_STRLEN_P(ent->data) = len;
					Z_STRVAL_P(ent->data) = estrndup(s, len);
				efree(tmp);

Fixed code:
--TEST--
Bug #72749: wddx_deserialize allows illegal memory access
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php
$xml = <<<XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
<header/>
        <data>
                <struct>
                     <var name='aDateTime3'>
                         <dateTime>2\r2004-09-10T05:52:49+00</dateTime>
                     </var>
                 </struct>
        </data>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
array(1) {
  ["aDateTime3"]=>
  string(24) "2
2004-09-10T05:52:49+00"
}
				if (Z_TYPE_P(ent->data) == IS_STRING) {
					tmp = safe_emalloc(Z_STRLEN_P(ent->data), 1, (size_t)len + 1);
					memcpy(tmp, Z_STRVAL_P(ent->data), Z_STRLEN_P(ent->data));
					memcpy(tmp + Z_STRLEN_P(ent->data), s, len);
					len += Z_STRLEN_P(ent->data);
					efree(Z_STRVAL_P(ent->data));
					Z_TYPE_P(ent->data) = IS_LONG;
				} else {
					tmp = emalloc(len + 1);
					memcpy(tmp, s, len);
				}
					ZVAL_STRINGL(ent->data, tmp, len, 0);
				} else {
					efree(tmp);
CVE-2016-7130 (C, published 2016-09-12T01:59Z)
Description: value: The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/php/php-src
Files changed:
ext/wddx/tests/bug72750.phpt
ext/wddx/wddx.c
Commit message: Fix bug #72750: wddx_deserialize null dereference


Vulnerable code:
			Z_STRVAL_P(ent1->data) = new_str;
			Z_STRLEN_P(ent1->data) = new_len;

Fixed code:
--TEST--
Bug #72750: wddx_deserialize null dereference
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml = <<< XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
<header/>
        <data>
                <struct>
                     <var name='aBinary'>
                         <binary length='11'>\\tYmluYXJRhdGE=</binary>
                     </var>
                 </struct>
        </data>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
array(1) {
  ["aBinary"]=>
  string(0) ""
}
			if (new_str) {
				Z_STRVAL_P(ent1->data) = new_str;
				Z_STRLEN_P(ent1->data) = new_len;
			} else {
				ZVAL_EMPTY_STRING(ent1->data);
			}
CVE-2016-7131 (Other, published 2016-09-12T01:59Z)
Description: value: ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/php/php-src
Files changed:
ext/wddx/tests/bug72790.phpt
ext/wddx/tests/bug72799.phpt
ext/wddx/wddx.c
Commit message: Fix for bug #72790 and bug #72799

(cherry picked from commit a14fdb9746262549bbbb96abb87338bacd147e1b)

Conflicts:
	ext/wddx/wddx.c


Vulnerable code:
			efree(ent1);

Fixed code:
--TEST--
Bug 72790: wddx_deserialize null dereference with invalid xml
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml = <<< XML
<?xml version='1.0' ?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
        |array>
                <var name="XXXX">
                        <boolean value="this">
                        </boolean>
                </var>
                <var name="YYYY">
                        <var name="UUUU">
                                <var name="EZEZ">
                                </var>
                        </var>
                </var>
        </array>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL
--TEST--
Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml = <<<XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version="1.0">
    <var name="XXXX">
        <boolean value="1">
            <dateTime>1998-06-12T04:32:12+00</dateTime>
        </boolean>
    </var>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL
				efree(ent1);
CVE-2016-7132 (Other, published 2016-09-12T01:59Z)
Description: value: ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/php/php-src
Files changed:
ext/wddx/tests/bug72790.phpt
ext/wddx/tests/bug72799.phpt
ext/wddx/wddx.c
Commit message: Fix for bug #72790 and bug #72799

(cherry picked from commit a14fdb9746262549bbbb96abb87338bacd147e1b)

Conflicts:
	ext/wddx/wddx.c


Vulnerable code:
			efree(ent1);

Fixed code:
--TEST--
Bug 72790: wddx_deserialize null dereference with invalid xml
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml = <<< XML
<?xml version='1.0' ?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
        |array>
                <var name="XXXX">
                        <boolean value="this">
                        </boolean>
                </var>
                <var name="YYYY">
                        <var name="UUUU">
                                <var name="EZEZ">
                                </var>
                        </var>
                </var>
        </array>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL
--TEST--
Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml = <<<XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version="1.0">
    <var name="XXXX">
        <boolean value="1">
            <dateTime>1998-06-12T04:32:12+00</dateTime>
        </boolean>
    </var>
</wddxPacket>
XML;

$array = wddx_deserialize($xml);
var_dump($array);
?>
--EXPECT--
NULL
				efree(ent1);
CVE-2016-7133 (C, published 2016-09-12T01:59Z)
Description: value: Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
Zend/zend_alloc.c
Commit message: Fix bug #72742 - memory allocator fails to realloc small block to large one


Vulnerable code:
			int old_bin_num, bin_num;

			old_bin_num = ZEND_MM_SRUN_BIN_NUM(info);
			bin_num = ZEND_MM_SMALL_SIZE_TO_BIN(size);
			if (old_bin_num == bin_num) {
				dbg = zend_mm_get_debug_info(heap, ptr);
				dbg->size = real_size;
				dbg->filename = __zend_filename;
				dbg->orig_filename = __zend_orig_filename;
				dbg->lineno = __zend_lineno;
				dbg->orig_lineno = __zend_orig_lineno;
				return ptr;

Fixed code:
			int old_bin_num = ZEND_MM_SRUN_BIN_NUM(info);
			if (size <= ZEND_MM_MAX_SMALL_SIZE) {
				int bin_num = ZEND_MM_SMALL_SIZE_TO_BIN(size);
				if (old_bin_num == bin_num) {
					dbg = zend_mm_get_debug_info(heap, ptr);
					dbg->size = real_size;
					dbg->filename = __zend_filename;
					dbg->orig_filename = __zend_orig_filename;
					dbg->lineno = __zend_lineno;
					dbg->orig_lineno = __zend_orig_lineno;
					return ptr;
				}
CVE-2016-7134 (C, published 2016-09-12T01:59Z)
Description: value: ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a denial of service (allocation error and heap-based buffer overflow) or possibly have unspecified other impact via a long string that is mishandled in a curl_escape call.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/php/php-src
Files changed:
ext/curl/interface.c
Commit message: Fix bug #72674 - check both curl_escape and curl_unescape


Vulnerable code:
	size_t        str_len = 0;
	if (str_len > INT_MAX) {

Fixed code:
	size_t     str_len = 0;
	if (ZEND_SIZE_T_INT_OVFL(str_len)) {
		RETURN_FALSE;
	}

	if (ZEND_SIZE_T_INT_OVFL(str_len)) {
CVE-2016-7412 (C, published 2016-09-17T21:59Z)
Description: value: ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag, which allows remote MySQL servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted field metadata.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/php/php-src
Files changed:
ext/mysqlnd/mysqlnd_wireprotocol.c
Commit message: Fix bug #72293 - Heap overflow in mysqlnd related to BIT fields


Vulnerable code:
		unsigned long len = php_mysqlnd_net_field_length(&p);

Fixed code:
	const zend_uchar * const packet_end = (zend_uchar*) row_buffer->ptr + data_size;
		const unsigned long len = php_mysqlnd_net_field_length(&p);
		if (len != MYSQLND_NULL_LENGTH && ((p + len) > packet_end)) {
			php_error_docref(NULL, E_WARNING, "Malformed server packet. Field length pointing "MYSQLND_SZ_T_SPEC
											  " bytes after end of packet", (p + len) - packet_end - 1);
			DBG_RETURN(FAIL);
		}
CVE-2016-7413 (C, published 2016-09-17T21:59Z)
Description: value: Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a wddxPacket XML document that lacks an end-tag for a recordset field element, leading to mishandling in a wddx_deserialize call.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/php/php-src
Files changed:
ext/wddx/tests/bug72860.phpt
ext/wddx/wddx.c
Commit message: Fix bug #72860: wddx_deserialize use-after-free


Vulnerable code:
			if (((st_entry *)stack->elements[i])->data)	{

Fixed code:
--TEST--
Bug #72860: wddx_deserialize use-after-free
--SKIPIF--
<?php
if (!extension_loaded('wddx')) {
    die('skip. wddx not available');
}
?>
--FILE--
<?php

$xml=<<<XML
<?xml version='1.0'?>
<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
<wddxPacket version='1.0'>
       <recordset fieldNames='F'>
               <field name='F'>
       </recordset>
</wddxPacket>
XML;

var_dump(wddx_deserialize($xml));
?>
DONE
--EXPECT--
NULL
DONE
			if (((st_entry *)stack->elements[i])->data
					&& ((st_entry *)stack->elements[i])->type != ST_FIELD)	{
CVE-2016-7414 (C, published 2016-09-17T21:59Z)
Description: value: The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/php/php-src
Files changed:
ext/phar/tests/bug72928.phpt
ext/phar/util.c
ext/phar/zip.c
Commit message: Fix bug #72928 - Out of bound when verify signature of zip phar in phar_parse_zipfile

(cherry picked from commit 19484ab77466f99c78fc0e677f7e03da0584d6a2)


Vulnerable code:
			if (read != entry.uncompressed_filesize) {

Fixed code:
--TEST--
Phar: #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)
--SKIPIF--
<?php if (!extension_loaded("phar")) die("skip"); ?>
--FILE--
<?php
chdir(__DIR__);
try {
$phar = new PharData('bug72928.zip');
var_dump($phar);
} catch(UnexpectedValueException $e) {
	print $e->getMessage()."\n";
}
?>
DONE
--EXPECTF--
phar error: signature cannot be read in zip-based phar "%sbug72928.zip"
DONE
			if (sig_len < sizeof(digest)) {
				if (error) {
					spprintf(error, 0, "broken signature");
				}
				return FAILURE;
			}

			if (sig_len < sizeof(digest)) {
				if (error) {
					spprintf(error, 0, "broken signature");
				}
				return FAILURE;
			}

			if (sig_len < sizeof(digest)) {
				if (error) {
					spprintf(error, 0, "broken signature");
				}
				return FAILURE;
			}

			if (sig_len < sizeof(digest)) {
				if (error) {
					spprintf(error, 0, "broken signature");
				}
				return FAILURE;
			}

			if (read != entry.uncompressed_filesize || read <= 8) {
CVE-2016-7416 (C, published 2016-09-17T21:59Z)
Description: value: ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/php/php-src
Files changed:
ext/intl/msgformat/msgformat_format.c
Commit message: Fix bug #73007: add locale length check


Vulnerable code:

Fixed code:
	INTL_CHECK_LOCALE_LEN(slocale_len);
CVE-2016-7417 (C, published 2016-09-17T21:59Z)
Description: value: ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/php/php-src
Files changed:
ext/spl/spl_array.c
ext/spl/tests/bug73029.phpt
Commit message: Fix bug #73029 - Missing type check when unserializing SplArray


Vulnerable code:
	if (!offset) {
			case IS_STRING: 
			case IS_BOOL: 
		if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)) {

Fixed code:
	if (!offset || !ht) {
			case IS_STRING:
			case IS_BOOL:
		if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)
				|| (Z_TYPE_P(intern->array) != IS_ARRAY && Z_TYPE_P(intern->array) != IS_OBJECT)) {
			zval_ptr_dtor(&intern->array);
--TEST--
Bug #73029: Missing type check when unserializing SplArray
--FILE--
<?php
try {
$a = 'C:11:"ArrayObject":19:0x:i:0;r:2;;m:a:0:{}}';
$m = unserialize($a);
$x = $m[2];
} catch(UnexpectedValueException $e) {
	print $e->getMessage() . "\n";
}
?>
DONE
--EXPECTF--
Error at offset 10 of 19 bytes
DONE
CVE-2016-7480 (C, published 2017-01-11T07:59Z)
Description: value: The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/php/php-src
Files changed:
ext/spl/spl_observer.c
Commit message: Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key


Vulnerable code:
		if (Z_TYPE(entry) != IS_OBJECT) {
			zval_ptr_dtor(&entry);
			goto outexcept;
		}
		} else {
			ZVAL_UNDEF(&inf);

Fixed code:
	ZVAL_UNDEF(&entry);
	ZVAL_UNDEF(&inf);

		}
		if (Z_TYPE(entry) != IS_OBJECT) {
			zval_ptr_dtor(&entry);
			zval_ptr_dtor(&inf);
			goto outexcept;
CVE-2016-7568 (Other, published 2016-09-28T20:59Z)
Description: value: Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted imagewebp and imagedestroy calls.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
NEWS
ext/gd/libgd/gd_webp.c
Commit message: Merge branch 'PHP-5.6' into PHP-7.0


Vulnerable code:

Fixed code:
   . Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c). (trylab,
     cmb)
+	if (overflow2(gdImageSX(im), 4)) {
+		return;
+	}
+
+	if (overflow2(gdImageSX(im) * 4, gdImageSY(im))) {
+		return;
+	}
+
CVE-2016-9933 (C, published 2017-01-04T20:59Z)
Description: value: Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/php/php-src
Files changed:
ext/gd/libgd/gd.c
ext/gd/tests/bug72696.phpt
Commit message: Fix #72696: imagefilltoborder stackoverflow on truecolor images

We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.


Vulnerable code:
	if (border < 0) {

Fixed code:
	if (border < 0 || color < 0) {
--TEST--
Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
--SKIPIF--
<?php
if (!extension_loaded('gd')) die('skip gd extension not available');
?>
--FILE--
<?php
$im = imagecreatetruecolor(10, 10);
imagefilltoborder($im, 0, 0, 1, -2);
?>
===DONE===
--EXPECT--
===DONE===