# imagefilltoborder stackoverflow on truecolor images

Invalid negative color value passed to imagefilltoborder on truecolor images causes infinite recursion in gdImageFillToBorder, exhausting the stack and crashing PHP.

- Payout: $500
- Severity: medium
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2017-02-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/190863
- Library page: https://bugbountylibrary.com/r/h1%3A190863
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:dos vuln:memory-corruption

**Target:** PHP GD extension (imagefilltoborder / libgd gdImageFillToBorder)
**Root cause:** gdImageFillToBorder recurses on adjacent pixels; with a truecolor image and an invalid color (-2 / 0xfffffffe) the border comparison never terminates, so it recurses between y and y+1 indefinitely until stack exhaustion.
**Steps:**
1. Create a truecolor image via imagecreatetruecolor()
2. Call imagefilltoborder($im, 0, 0, 1, -2) with an invalid negative color
3. Observe recursive calls to gdImageFillToBorder alternating y=0/y=1 in gdb until stack overflow
**How found:** Researcher tested imagefilltoborder with an invalid color on a truecolor image and used gdb breakpoints on gd.c:1834/1851 to observe the recursion bouncing between y=0 and y=1 with color=0xfffffffe.
**Exploitation:** Attacker supplies an invalid color argument to imagefilltoborder on a truecolor image, triggering unbounded recursion and stack exhaustion, crashing the PHP process (DoS).
**Insight:** Fuzz image-processing API arguments with out-of-range/negative values (colors, coordinates) on truecolor vs palette images; recursive flood-fill implementations can loop forever when the border/color comparison never matches.