If I&#x27;m reading this comment <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10567353" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10567353</a> and this code <a href="https:&#x2F;&#x2F;github.com&#x2F;libgd&#x2F;libgd&#x2F;blob&#x2F;4751b606fa38edc456d627140898a7ec679fcc24&#x2F;src&#x2F;gd_png.c" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;libgd&#x2F;libgd&#x2F;blob&#x2F;4751b606fa38edc456d62714...</a> correctly, then it looks like GD isn&#x27;t vulnerable since it uses num_palette to size the palette rather than info_ptr-&gt;palette or bit_depth