Fix GH-19751: imagefill buffer overflow.

Author: devnexen

ext/gd/libgd/gd.c

@@ -2043,6 +2043,9 @@ static void _gdImageFillTiled(gdImagePtr im, int x, int y, int nc)
  	FILL_PUSH(y+1, x, x, -1);
 	while (sp>stack) {
 		FILL_POP(y, x1, x2, dy);
+		if (y > im->sy || x > im->sx) {
+			goto skip;
+		}
 		for (x=x1; x>=0 && (!pts[y][x] && gdImageGetPixel(im,x,y)==oc); x--) {
 			nc = gdImageTileGet(im,x,y);
 			pts[y][x] = 1;