MFH: Fixed bug #30281 (Prevent non-wbmp images from being detected as such)

diff --git a/NEWS b/NEWS
index 4be8ecd187e65da4f6eb8479a7ee4842ddd5a6c7..54a24cdde8afa69b8622ab686e2c500247bb4ff4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,8 +1,10 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2004, PHP 5.0.3
-- Fixed bug #30282 (segfault when using unknown/unsupported session.save_handler 
-  and/or session.serialize_handler). (Tony)
+- Fixed bug #30282 (segfault when using unknown/unsupported 
+  session.save_handler and/or session.serialize_handler). (Tony)
+- Fixed bug #30281 (Prevent non-wbmp images from being detected as such).
+  (Ilia)
 - Fixed bug #30276 (Possible crash in ctype_digit on large numbers). (Ilia)
 - Fixed bug #30224 (Sybase date strings are sometimes not null terminated).
   (Ilia)

diff --git a/ext/standard/image.c b/ext/standard/image.c
index 8b85ab71927e72ecbaf6149a9302fe001646b0bf..4df21442ba57803efdde5ec21017b819433aaba1 100644 (file)
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -957,7 +957,7 @@ static int php_get_wbmp(php_stream *stream, struct gfxinfo **result, int check T
        } while (i & 0x80);
 
        /* maximum valid sizes for wbmp (although 127x127 may be a more accurate one) */
-       if (height > 2048 || width > 2048) {
+       if (!height || !width || height > 2048 || width > 2048) {
                return 0;
        }