# imagecropauto out-of-bounds access

imagecropauto in GD_CROP_THRESHOLD mode fails to validate palette color index, causing out-of-bounds reads of red/green/blue/alpha arrays and info leak.

- Payout: $500
- Severity: low
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/178144
- Library page: https://bugbountylibrary.com/r/h1%3A178144
- Tags: domain:oss impact:data-leak kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** PHP ext/gd imagecropauto (gdImageCropThreshold/gdColorMatch)
**Root cause:** PHP only checks color >= 0 before passing it to gdImageCropThreshold; gdColorMatch uses the color as an index into im->red/green/blue/alpha arrays (size 256) without bounds checking for non-truecolor images.
**Steps:**
1. Create a palette (non-truecolor) image via imagecreate()
2. Call `imagecropauto($im, IMG_CROP_THRESHOLD, 0.0, 1337)` with color > 255
3. gdColorMatch indexes im->red[1337] etc., reading past the 256-entry arrays
4. Observe OOB read in gdb at gd_crop.c:350 with col1=0x539
**How found:** Code reading of gd.c showed only a `color < 0` check; tracing into gdColorMatch revealed the color is used directly as an array index in gdImageRed/Green/Blue/Alpha macros, which are unbounded for palette images.
**Exploitation:** Attacker supplies an out-of-range color to imagecropauto threshold mode; the macros read adjacent heap memory as color channel values, potentially leaking memory contents through crop behavior. No full end-to-end leak demonstrated in text.
**Insight:** When a numeric parameter is validated only for sign, check whether it later indexes fixed-size palette arrays (256 entries) in image libraries; palette vs truecolor code paths diverge and often skip bounds checks.