Description: fix denial of service via invalid color index
Origin: backport, https://github.com/libgd/libgd/compare/3fe0a7128bac5000fdcfab888bd2a75ec0c9447d...fd623025505e87bba7ec8555eeb72dae4fb0afd
Bug: https://bugs.php.net/bug.php?id=72494
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829062

Index: libgd2-2.1.1/src/gd_crop.c
===================================================================
--- libgd2-2.1.1.orig/src/gd_crop.c	2016-07-08 14:18:17.453240529 -0400
+++ libgd2-2.1.1/src/gd_crop.c	2016-07-08 14:18:17.449240477 -0400
@@ -136,6 +136,10 @@
 		return NULL;
 	}
 
+	if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) {
+		return NULL;
+	}
+
 	/* TODO: Add gdImageGetRowPtr and works with ptr at the row level
 	 * for the true color and palette images
 	 * new formats will simply work with ptr
Index: libgd2-2.1.1/tests/CMakeLists.txt
===================================================================
--- libgd2-2.1.1.orig/tests/CMakeLists.txt	2016-07-08 14:18:17.453240529 -0400
+++ libgd2-2.1.1/tests/CMakeLists.txt	2016-07-08 14:18:54.461711711 -0400
@@ -31,6 +31,7 @@
 		gdimagecolortransparent
 		gdimagecopy
 		gdimagecopyrotated
+		gdimagecrop
 		gdimagefill
 		gdimagefilledellipse
 		gdimagefilledpolygon
Index: libgd2-2.1.1/tests/Makefile.am
===================================================================
--- libgd2-2.1.1.orig/tests/Makefile.am	2016-07-08 14:18:17.453240529 -0400
+++ libgd2-2.1.1/tests/Makefile.am	2016-07-08 14:22:22.740361562 -0400
@@ -17,6 +17,7 @@
 	tga/tga_null \
 	gdimagepixelate/gdimagepixelate \
 	gdimagecopy/bug00007 \
+	gdimagecrop/php_bug_72494 \
 	gdnewfilectx/gdnewfilectx_null \
 	gdimagefilledrectangle/bug00078 \
 	gdimagefilledrectangle/bug00004 \
Index: libgd2-2.1.1/tests/gdimagecrop/php_bug_72494.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ libgd2-2.1.1/tests/gdimagecrop/php_bug_72494.c	2016-07-08 14:18:17.449240477 -0400
@@ -0,0 +1,22 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include "gd.h"
+
+#include "gdtest.h"
+
+int main()
+{
+	gdImagePtr im;
+
+	im = gdImageCreate(50, 50);
+
+	if (!im) {
+		gdTestErrorMsg("gdImageCreate failed.\n");
+		return 1;
+	}
+
+	gdImageCropThreshold(im, 1337, 0);
+	gdImageDestroy(im);
+	/* this bug tests a crash, it never reaches this point if the bug exists*/
+	return 0;
+}
