diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index 71a0e9ea63f2..9563354a99d8 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -2879,12 +2879,12 @@ void gdImageFilledPolygon (gdImagePtr im, gdPointPtr p, int n, int c) void gdImageSetStyle (gdImagePtr im, int *style, int noOfPixels) { - if (im->style) { - gdFree(im->style); - } if (overflow2(sizeof (int), noOfPixels)) { return; } + if (im->style) { + gdFree(im->style); + } im->style = (int *) gdMalloc(sizeof(int) * noOfPixels); memcpy(im->style, style, sizeof(int) * noOfPixels); im->styleLength = noOfPixels; diff --git a/ext/gd/tests/gh22121.phpt b/ext/gd/tests/gh22121.phpt new file mode 100644 index 000000000000..3a55fb5fa5a5 --- /dev/null +++ b/ext/gd/tests/gh22121.phpt @@ -0,0 +1,23 @@ +--TEST-- +GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return) +--EXTENSIONS-- +gd +--INI-- +memory_limit=-1 +--SKIPIF-- + +--FILE-- + +--EXPECTF-- +Warning: imagesetstyle(): Product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully + in %s on line %d +no double free