Fixed bug #67024 - getimagesize should recognize BMP files with negative height

diff --git a/NEWS b/NEWS
index 206111009cd43ec4d29c67c0cd81e8921cfb5a3d..4d5441e28ed06ea9db0392bc75f81f75f387a1c2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,8 @@ PHP                                                                        NEWS
     UNIX sockets). (Mike)
   . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)
   . Fixed bug #66736 (fpassthru broken). (Mike)
+  . Fixed bug #67024 (getimagesize should recognize BMP files with negative 
+    height). (Gabor Buella)
 
 - Embed:
   . Fixed bug #65715 (php5embed.lib isn't provided anymore). (Anatol)

diff --git a/ext/standard/image.c b/ext/standard/image.c
index 27f60c95a70fda5e9f1c8704aabf6db0a5d9e6f9..816de44d4ceee250941c7c5f90209dbe23fee993 100644 (file)
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -163,6 +163,7 @@ static struct gfxinfo *php_handle_bmp (php_stream * stream TSRMLS_DC)
                result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
                result->width    =  (((unsigned int)dim[ 7]) << 24) + (((unsigned int)dim[ 6]) << 16) + (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
                result->height   =  (((unsigned int)dim[11]) << 24) + (((unsigned int)dim[10]) << 16) + (((unsigned int)dim[ 9]) << 8) + ((unsigned int) dim[ 8]);
+               result->height   =  abs((int32_t)result->height);
                result->bits     =  (((unsigned int)dim[15]) <<  8) +  ((unsigned int)dim[14]);
        } else {
                return NULL;

diff --git a/ext/standard/tests/image/getimagesize.phpt b/ext/standard/tests/image/getimagesize.phpt
index 6cd8275e06e386314cbfd8e3dc49e535534a1723..04ddd8c82b20db3ad9cc8331a236236c30195a17 100644 (file)
--- a/ext/standard/tests/image/getimagesize.phpt
+++ b/ext/standard/tests/image/getimagesize.phpt
@@ -23,7 +23,22 @@ GetImageSize()
        var_dump($result);
 ?>
 --EXPECT--
-array(12) {
+array(13) {
+  ["test-1pix.bmp"]=>
+  array(6) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(1)
+    [2]=>
+    int(6)
+    [3]=>
+    string(20) "width="1" height="1""
+    ["bits"]=>
+    int(24)
+    ["mime"]=>
+    string(14) "image/x-ms-bmp"
+  }
   ["test1bpix.bmp"]=>
   array(6) {
     [0]=>

diff --git a/ext/standard/tests/image/image_type_to_mime_type.phpt b/ext/standard/tests/image/image_type_to_mime_type.phpt
index d83ab8d146c4ba233bbea192d68234c6b60343aa..9f7ffa1aa34b42760422720159b4b4f2f75d85fa 100644 (file)
--- a/ext/standard/tests/image/image_type_to_mime_type.phpt
+++ b/ext/standard/tests/image/image_type_to_mime_type.phpt
@@ -25,7 +25,9 @@ image_type_to_mime_type()
        var_dump($result);
 ?>
 --EXPECT--
-array(12) {
+array(13) {
+  ["test-1pix.bmp"]=>
+  string(14) "image/x-ms-bmp"
   ["test1bpix.bmp"]=>
   string(14) "image/x-ms-bmp"
   ["test1pix.bmp"]=>

diff --git a/ext/standard/tests/image/test-1pix.bmp b/ext/standard/tests/image/test-1pix.bmp
new file mode 100644 (file)
index 0000000..ec68a57
Binary files /dev/null and b/ext/standard/tests/image/test-1pix.bmp differ