# select_colors write out-of-bounds

Integer truncation in PHP GD's imagepalettetotruecolor lets a 64-bit ncolors value wrap to 0, causing select_colors to under-allocate and write out of bounds.

- Payout: $1,000
- Severity: high
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/161189
- Library page: https://bugbountylibrary.com/r/h1%3A161189
- Tags: domain:oss impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:memory-corruption

**Target:** PHP GD extension, zif_imagetruecolortopalette / gdImageTrueColorToPalette
**Root cause:** ncolors is a 64-bit zend_long but colorsWanted in php_gd_gdImageTrueColorToPalette is 32-bit; value 0x1000000000000000 truncates to 0, so select_colors allocates too little memory.
**Steps:**
1. Call imagepalettetotruecolor or imagetruecolortopalette with ncolors=0x1000000000000000
2. Observe truncation to 0 in php_gd_gdImageTrueColorToPalette
3. select_colors allocates based on truncated count
4. Subsequent writes exceed allocation -> OOB write
**How found:** Code reading of the type mismatch between the 64-bit zend_long parameter and the 32-bit colorsWanted in the GD wrapper, then tracing the truncated value into select_colors allocation.
**Insight:** Audit PHP extension wrappers for width mismatches between zend_long (64-bit) and C int parameters in bundled libraries; a value that truncates to 0 or small can under-allocate before a write loop.