# Illegal write/read access caused by gdImageAALine overflow

Integer overflow in gdImageAALine clipping math causes out-of-bounds write/read in gdImageSetAAPixelColor when drawing anti-aliased lines in PHP GD.

- Payout: $500
- Severity: low
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/182420
- Library page: https://bugbountylibrary.com/r/h1%3A182420
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:memory-corruption

**Target:** PHP GD extension (gdImageAALine / gdImageSetAAPixelColor)
**Root cause:** Line-clipping arithmetic `x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1)` overflows the intermediate multiplication, producing wrong clipped coordinates that bypass bounds checks.
**Steps:**
1. Craft an image and call an image line-drawing function (e.g. imageline) with coordinates that trigger the AA path (gdImageAALine).
2. Choose endpoints such that `(im->sy - y2) * (x1 - x2)` overflows int during clipping.
3. Observe the computed x2 differs from the mathematically correct value (e.g. 0x0 vs 0x40000c10).
4. The bad coordinate reaches gdImageSetAAPixelColor, which writes/reads outside the pixel buffer.
**How found:** Debugging in gdb: compared `(a*b)/c` vs `a*(b/c)` for the clipping expression and noticed the multiplication overflowed to 0 while the reordered form gave a large value, revealing the overflow in gdImageAALine's limit calculation.
**Exploitation:** Attacker supplies crafted line coordinates to a GD AA line-drawing call, causing out-of-bounds memory access in the pixel buffer; demonstrated via gdb debugging showing the overflow and illegal write.
**Insight:** In graphics/clipping code, integer overflow in intermediate products of coordinate math silently defeats bounds checks; test extreme coordinate values and compare against a reordered expression to spot overflow.