[php-maint] Bug#514609: php5-gd: Segfault after infinite recursion in imagefill / gdImageFill

[Chris West (Faux)]

Package: php5-gd
Version: 5.2.0-8+etch13
Severity: normal

The following code:

<?php
$im = imagecreatetruecolor(1000, 500);
$c = imagecolorallocatealpha($im,0,0,0,127);
imagefill($im, 1, 1, $c);

... stack-overflows and segfaults.

faux at hoki:~% php debug.php
zsh: segmentation fault  php debug.php

You may need to increase the size of the image, and it'll happen faster witha ulimit -s set.

(stack actually taken on a different etch machine)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 47672849432560 (LWP 10921)]
0x00002b5bb5247d24 in gdImageSetPixel () from /usr/lib/libgd.so.2
(gdb) bt
#0  0x00002b50a59d9d24 in gdImageSetPixel () from /usr/lib/libgd.so.2
#1  0x00002b50a59dae51 in gdImageFill () from /usr/lib/libgd.so.2
#2  0x00002b50a59db04c in gdImageFill () from /usr/lib/libgd.so.2
#3  0x00002b50a59db033 in gdImageFill () from /usr/lib/libgd.so.2
[...]
#1051 0x00002b50a59db033 in gdImageFill () from /usr/lib/libgd.so.2
#1052 0x00002b50a59db04c in gdImageFill () from /usr/lib/libgd.so.2
#1053 0x00002b50a59db033 in gdImageFill () from /usr/lib/libgd.so.2
#1054 0x00002b50a58b6b93 in zif_imagefill () from /usr/lib/php5/20060613/gd.so
#1055 0x0000000000660447 in execute ()
#1056 0x000000000064fe63 in execute ()
#1057 0x0000000000632ec9 in zend_execute_scripts ()
#1058 0x00000000005f3678 in php_execute_script ()
#1059 0x00000000006b9755 in main ()



-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (700, 'stable'), (400, 'testing')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-6-xen-amd64
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)

Versions of packages php5-gd depends on:
ii  libc6                    2.7-18          GNU C Library: Shared libraries
ii  libfreetype6             2.3.7-2         FreeType 2 font engine, shared lib
ii  libgd2-xpm               2.0.33-5.2etch1 GD Graphics Library version 2
ii  libjpeg62                6b-13           The Independent JPEG Group's JPEG 
ii  libpng12-0               1.2.15~beta5-1  PNG library - runtime
ii  libt1-5                  5.1.0-2etch1    Type 1 font rasterizer library - r
ii  libx11-6                 2:1.0.3-7       X11 client-side library
ii  libxpm4                  1:3.5.5-2       X11 pixmap library
ii  php5-cgi [phpapi-2006061 5.2.0-8+etch13  server-side, HTML-embedded scripti
ii  php5-cli [phpapi-2006061 5.2.0-8+etch13  command-line interpreter for the p
ii  php5-common              5.2.0-8+etch13  Common files for packages built fr
ii  zlib1g                   1:1.2.3-13      compression library - runtime

php5-gd recommends no packages.

-- no debconf information