Description: fix out-of-bounds read issue with unsupported TGA bpp/alphabit combinations
Origin: backport, https://github.com/libgd/libgd/commit/2733b623ee08eca6b277ad8b0b89251462c09435
Origin: backport, https://github.com/libgd/libgd/commit/cb1a0b7e54e9aa118270c23a4a6fe560e4590dc9

Index: libgd2-2.1.1/src/gd_tga.c
===================================================================
--- libgd2-2.1.1.orig/src/gd_tga.c	2016-08-09 11:50:06.689180635 -0400
+++ libgd2-2.1.1/src/gd_tga.c	2016-08-09 11:51:46.698468632 -0400
@@ -61,7 +61,7 @@
 	tga->bitmap = NULL;
 	tga->ident = NULL;
 
-	if (!read_header_tga(ctx, tga)) {
+	if (read_header_tga(ctx, tga) < 0) {
 		free_tga(tga);
 		return NULL;
 	}
@@ -71,7 +71,7 @@
 		image_block_size = (tga->width * tga->height) * pixel_block_size;
 	*/
 
-	if (read_image_tga(ctx, tga)) {
+	if (read_image_tga(ctx, tga) < 0) {
 		free_tga(tga);
 		return NULL;
 	}
@@ -99,7 +99,7 @@
 			if (tga->bits == TGA_BPP_24) {
 				*tpix = gdTrueColor(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret]);
 				bitmap_caret += 3;
-			} else if (tga->bits == TGA_BPP_32 || tga->alphabits) {
+			} else if (tga->bits == TGA_BPP_32 && tga->alphabits) {
 				register int a = tga->bitmap[bitmap_caret + 3];
 
 				*tpix = gdTrueColorAlpha(tga->bitmap[bitmap_caret + 2], tga->bitmap[bitmap_caret + 1], tga->bitmap[bitmap_caret], gdAlphaMax - (a >> 1));
@@ -159,16 +159,12 @@ int read_header_tga(gdIOCtx *ctx, oTga *tga)
 	printf("wxh: %i %i\n", tga->width, tga->height);
 #endif
 
-	switch(tga->bits) {
-	case 8:
-	case 16:
-	case 24:
-	case 32:
-		break;
-	default:
-		gd_error("bps %i not supported", tga->bits);
+	if (!((tga->bits == TGA_BPP_24 && tga->alphabits == 0)
+		|| (tga->bits == TGA_BPP_32 && tga->alphabits == 8)))
+	{
+		gd_error_ex(GD_WARNING, "gd-tga: %u bits per pixel with %u alpha bits not supported\n",
+			tga->bits, tga->alphabits);
 		return -1;
-		break;
 	}
 
 	tga->ident = NULL;
