Fix CVE-2019-6977:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6977

Patch copied from Debian:

https://salsa.debian.org/debian/libgd2/commit/2d7d3b68bb79843e5271a05543e996fd5a3a8cd1

Description: Heap-based buffer overflow in gdImageColorMatch
Origin: other, https://gist.github.com/cmb69/1f36d285eb297ed326f5c821d7aafced
Bug-PHP: https://bugs.php.net/bug.php?id=77270
Bug-Debian: https://bugs.debian.org/920645
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-6977
Forwarded: no
Author: "Christoph M. Becker" <cmbecker69@gmx.de>
Last-Update: 2019-02-01

At least some of the image reading functions may return images which
use color indexes greater than or equal to im->colorsTotal.  We cater
to this by always using a buffer size which is sufficient for
`gdMaxColors` in `gdImageColorMatch()`.
---

--- a/src/gd_color_match.c
+++ b/src/gd_color_match.c
@@ -31,8 +31,8 @@ BGD_DECLARE(int) gdImageColorMatch (gdIm
 		return -4; /* At least 1 color must be allocated */
 	}
 
-	buf = (unsigned long *)gdMalloc(sizeof(unsigned long) * 5 * im2->colorsTotal);
-	memset (buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal );
+	buf = (unsigned long *)gdMalloc(sizeof(unsigned long) * 5 * gdMaxColors);
+	memset (buf, 0, sizeof(unsigned long) * 5 * gdMaxColors );
 
 	for (x=0; x < im1->sx; x++) {
 		for( y=0; y<im1->sy; y++ ) {
ix/commit/nix/libstore/derivations.cc?id=4230de5b9807e9a522feccdd86b8d8f8b2d360a0'>commit</a><a href='/guix/diff/nix/libstore/derivations.cc?id=4230de5b9807e9a522feccdd86b8d8f8b2d360a0'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/nix/libstore/derivations.cc'>
<input type='hidden' name='id' value='4230de5b9807e9a522feccdd86b8d8f8b2d360a0'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=4230de5b9807e9a522feccdd86b8d8f8b2d360a0'>root</a>/<a href='/guix/log/nix?id=4230de5b9807e9a522feccdd86b8d8f8b2d360a0'>nix</a>/<a href='/guix/log/nix/libstore?id=4230de5b9807e9a522feccdd86b8d8f8b2d360a0'>libstore</a>/<a href='/guix/log/nix/libstore/derivations.cc?id=4230de5b9807e9a522feccdd86b8d8f8b2d360a0'>derivations.cc</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/nix/libstore/derivations.cc?id=4230de5b9807e9a522feccdd86b8d8f8b2d360a0&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>