MFH: Fixed crash inside cpdf_place_inline_image() when working with

truecolor images.

diff --git a/NEWS b/NEWS
index 0149f526e788881c4edb7983cafd886e6d60bfd4..e4e35b707e725345206535cd0e02c3ffb8f332a7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@ PHP 4                                                                      NEWS
 - Upgraded bundled GD library to 2.0.23. (Ilia)
 - Fixed possible crash inside pg_copy_(to|from) function if delimiter is more
   then 1 character long. (Ilia)
+- Fixed crash inside cpdf_place_inline_image() when working with truecolor
+  images. (Ilia)
 - Fixed handling of return values from storred procedures in mssql_execute()
   with multiple result sets returned. (Frank)
 - Fixed logic bug in session_register() which allowed registering _SESSION

diff --git a/ext/cpdf/cpdf.c b/ext/cpdf/cpdf.c
index 8328c718394c4d1ea27eb7ee461ea06bef30ba03..88655ff1d1e7aba0b05a29e4fc7b98550921e6c0 100644 (file)
--- a/ext/cpdf/cpdf.c
+++ b/ext/cpdf/cpdf.c
@@ -2522,16 +2522,30 @@ PHP_FUNCTION(cpdf_place_inline_image)
        }
 
        count = 3 * im->sx * im->sy;
-       if(NULL == (buffer = (unsigned char *) emalloc(count)))
-               RETURN_FALSE;
+       buffer = (unsigned char *) safe_emalloc(3 * im->sx, im->sy, 0);
 
        ptr = buffer;
        for(i=0; i<im->sy; i++) {
                for(j=0; j<im->sx; j++) {
-                       color = im->pixels[i][j];
-                       *ptr++ = im->red[color];
-                       *ptr++ = im->green[color];
-                       *ptr++ = im->blue[color];
+#if HAVE_LIBGD20
+                       if(gdImageTrueColor(im)) {
+                               if (im->tpixels && gdImageBoundsSafe(im, j, i)) {
+                                       color = gdImageTrueColorPixel(im, j, i);
+                                       *ptr++ = (color >> 16) & 0xFF;
+                                       *ptr++ = (color >> 8) & 0xFF;
+                                       *ptr++ = color & 0xFF;
+                               }
+                       } else {
+#endif
+                               if (im->pixels && gdImageBoundsSafe(im, j, i)) {
+                                       color = im->pixels[i][j];
+                                       *ptr++ = im->red[color];
+                                       *ptr++ = im->green[color];
+                                       *ptr++ = im->blue[color];
+                               }
+#if HAVE_LIBGD20
+                       }
+#endif
                }
        }