Description: fix integer overflow in _gd2GetHeader()
Origin: backport, https://github.com/libgd/libgd/commit/aba3db8ba159465ecec1089027a24835a6da9cc0
Origin: backport, https://github.com/libgd/libgd/commit/a6a0e7feabb2a9738086a5dc96348f233c87fa79
Bug: https://bugs.php.net/bug.php?id=72339

Index: libgd2-2.1.1/src/gd_gd2.c
===================================================================
--- libgd2-2.1.1.orig/src/gd_gd2.c	2016-07-08 14:18:04.069070099 -0400
+++ libgd2-2.1.1/src/gd_gd2.c	2016-07-08 14:18:04.065070049 -0400
@@ -154,10 +154,18 @@
 
 	if (gd2_compressed (*fmt)) {
 		nc = (*ncx) * (*ncy);
+
 		GD2_DBG (printf ("Reading %d chunk index entries\n", nc));
+		if (overflow2(sizeof(t_chunk_info), nc)) {
+			goto fail1;
+		}
 		sidx = sizeof (t_chunk_info) * nc;
+		if (sidx <= 0) {
+			goto fail1;
+		}
+
 		cidx = gdCalloc (sidx, 1);
-		if (!cidx) {
+		if (cidx == NULL) {
 			goto fail1;
 		}
 		for (i = 0; i < nc; i++) {
