- CVE-2016-5767: integer overflow in gdImageCreate() of the bundled libgd (ext/gd/libgd/gd.c) leading to a heap buffer overflow (php.net bug #72446). Backport upstream commit c395c6e5d7e8df37a21265ff76e48fe75ceb5ae6, first released in PHP 5.5.37 and 5.6.23: gdImageCreate() validated only "sx * sy" and "sizeof(unsigned char *) * sy" before allocating a palette image and never checked that the width alone can be scaled by a pointer/int-sized factor without wrapping, so a crafted image width could produce undersized per-row buffers that are later written for the full logical width. Add the missing "overflow2(sizeof(unsigned char *), sx)" guard so such an image is rejected at creation time. Only the functional hunk is carried over; the remainder of the upstream commit is trailing whitespace cleanup