Package: libgd-xpm
Version: libgd2-xpm
Severity: normal
Tags: patch
This is http://bugs.libgd.org/?do=details&task_id=177 (patch included).
Fixed in php bundled gd in http://bugs.php.net/51128
But still present in Lenny as of libgd2-xpm 2.0.36~rc1~dfsg-3+lenny1
-- System Information:
Debian Release: 5.0.5
APT prefers stable
diff -uNr -ur php-5.2.5.orig/ext/gd/libgd/gd.c php-5.2.5/ext/gd/libgd/gd.c
--- php-5.2.5.orig/ext/gd/libgd/gd.c 2007-11-04 17:56:00.000000000 -0600
+++ php-5.2.5/ext/gd/libgd/gd.c 2008-10-16 13:03:41.000000000 -0500
@@ -1938,9 +1938,9 @@
struct seg {int y, xl, xr, dy;};
/* max depth of stack */
-#define FILL_MAX 1200000
+#define FILL_MAX ((int)(im->sy*im->sx)/4)
#define FILL_PUSH(Y, XL, XR, DY) \
- if (sp<stack+FILL_MAX*10 && Y+(DY)>=0 && Y+(DY)<wy2) \
+ if (sp<stack+FILL_MAX && Y+(DY)>=0 && Y+(DY)<wy2) \
{sp->y = Y; sp->xl = XL; sp->xr = XR; sp->dy = DY; sp++;}
#define FILL_POP(Y, XL, XR, DY) \
