#72482, Ilegal write/read access caused by gdImageAALine overflow

Author: pierrejoye

ext/gd/libgd/gd.c

@@ -1301,55 +1301,10 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 long x, y, inc;
 long dx, dy,tmp;
 
-if (y1 < 0 && y2 < 0) {
-return;
-}
-if (y1 < 0) {
-x1 += (y1 * (x1 - x2)) / (y2 - y1);
-y1 = 0;
-}
-if (y2 < 0) {
-x2 += (y2 * (x1 - x2)) / (y2 - y1);
-y2 = 0;
-}
-
-/* bottom edge */
-if (y1 >= im->sy && y2 >= im->sy) {
-return;
-}
-if (y1 >= im->sy) {
-x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1);
-y1 = im->sy - 1;
-}
-if (y2 >= im->sy) {
-x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1);
-y2 = im->sy - 1;
-}
-
-/* left edge */
-if (x1 < 0 && x2 < 0) {
-return;
-}
-if (x1 < 0) {
-y1 += (x1 * (y1 - y2)) / (x2 - x1);
-x1 = 0;
-}
-if (x2 < 0) {
-y2 += (x2 * (y1 - y2)) / (x2 - x1);
-x2 = 0;
-}
-/* right edge */
-if (x1 >= im->sx && x2 >= im->sx) {
+/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
+if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) {
 return;
 }
-if (x1 >= im->sx) {
-y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1);
-x1 = im->sx - 1;
-}
-if (x2 >= im->sx) {
-y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1);
-x2 = im->sx - 1;
-}
 
 dx = x2 - x1;
 dy = y2 - y1;