- check max colors while loading gd2 palette image (patch by Tomas Hoger)

ext/gd/libgd/gd_gd.c

@@ -39,6 +39,9 @@ int _gdGetColors (gdIOCtx * in, gdImagePtr im, int gd2xFlag)
 			if (!gdGetWord(&im->colorsTotal, in)) {
 				goto fail1;
 			}
+			if (im->colorsTotal > gdMaxColors) {
+				goto fail1;
+			}
 		}
 		/* Int to accommodate truecolor single-color transparency */
 		if (!gdGetInt(&im->transparent, in)) {

ext/gd/tests/crafted_gd2.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Test max colors for a gd image.
+--SKIPIF--
+<?php
+	if (!extension_loaded('gd')) {
+		die("skip gd extension not available\n");
+	}
+?>
+--FILE--
+<?php
+imagecreatefromgd(dirname(__FILE__) . '/crafted.gd2');
+?>
+--EXPECTF--
+
+Warning: imagecreatefromgd(): '%scrafted.gd2' is not a valid GD file in %s on line %d
+