Commit d3acdf5

committed

Fix GH-19730: imageaffine integer overflow on affine matrix.

1 parent 9d69ab9 commit d3acdf5Copy full SHA for d3acdf5

File tree

-2

lines changed

-2

lines changed

Lines changed: 9 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -2461,10 +2461,17 @@ int gdTransformAffineBoundingBox(gdRectPtr src, const double affine[6], gdRectPt`
`2461`	`2461`	`if (max.y < extent[i].y)`
`2462`	`2462`	`max.y=extent[i].y;`
`2463`	`2463`	`}`
	`2464`	`+ double twidth = floor(max.x - min.x) - 1;`
	`2465`	`+ double theight = floor(max.y - min.y);`
	`2466`	`+`
	`2467`	`+ if (twidth < (double)INT_MIN \|\| twidth > (double)INT_MAX \|\|`
	`2468`	`+ theight < (double)INT_MIN \|\| theight > (double)INT_MAX)`
	`2469`	`+ return GD_FALSE;`
	`2470`	`+`
`2464`	`2471`	`bbox->x = (int) min.x;`
`2465`	`2472`	`bbox->y = (int) min.y;`
`2466`		`- bbox->width = (int) floor(max.x-min.x) -1;`
`2467`		`- bbox->height = (int) floor(max.y-min.y);`
	`2473`	`+ bbox->width = (int) twidth;`
	`2474`	`+ bbox->height = (int) theight;`
`2468`	`2475`	`return GD_TRUE;`
`2469`	`2476`	`}`
`2470`	`2477`

Comments

(0)