# imagegammacorrect allows arbitrary write access

imagegammacorrect with opposite-sign gamma values overflows palette colors, producing a negative transparent-color index that enables an arbitrary null-byte write in PHP GD.

- Payout: $1,000
- Severity: high
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-13
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/161193
- Library page: https://bugbountylibrary.com/r/h1%3A161193
- Tags: domain:oss impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:memory-corruption

**Target:** PHP GD extension imagegammacorrect()
**Root cause:** Opposite-sign gamma values cause palette colors to exceed 0xFF; gdTrueColorAlpha then computes a negative transparent color used as an array index, yielding an out-of-bounds write.
**Steps:**
1. Call `imagegammacorrect($img, $gamma_in, $gamma_out)` with gamma values of opposite signs on a palette image.
2. Palette color components exceed 0xFF after gamma correction.
3. gdTrueColorAlpha computes transparent color from the overflowed values, producing a negative index.
4. Negative index used as write offset, allowing an arbitrary null write (similar to bug #72512).
**How found:** Noticed that opposite-sign gamma inputs push palette color values above 0xFF, then traced how those values flow into gdTrueColorAlpha and become a negative transparent-color index, recalling the analogous bug #72512.
**Insight:** When auditing image-processing APIs, look for arithmetic on color/channel values that can exceed the 0xFF range and then get reused as indices or offsets in macros like gdTrueColorAlpha.