- #37360, bad gif size

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 9d1c6cc918bf81bf1c0407a91c5d72d2f1755412..0b20c6bc30358b9794a87dc3942a3078efe68c5b 100644 (file)
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -146,6 +146,9 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd)
        Background      = buf[5];
        AspectRatio     = buf[6];
 
+       imw = LM_to_uint(buf[0],buf[1]);
+       imh = LM_to_uint(buf[2],buf[3]);
+
        if (BitSet(buf[4], LOCALCOLORMAP)) {    /* Global Colormap */
                if (ReadColorMap(fd, BitPixel, ColorMap)) {
                        return 0;
@@ -181,9 +184,6 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd)
 
                bitPixel = 1<<((buf[8]&0x07)+1);
 
-               imw = LM_to_uint(buf[4],buf[5]);
-               imh = LM_to_uint(buf[6],buf[7]);
-
                if (!useGlobalColormap) {
                        if (ReadColorMap(fd, bitPixel, localColorMap)) {
                                return 0;

diff --git a/ext/gd/tests/bug37360.gif b/ext/gd/tests/bug37360.gif
new file mode 100644 (file)
index 0000000..3f9e6c5
Binary files /dev/null and b/ext/gd/tests/bug37360.gif differ

diff --git a/ext/gd/tests/bug37360.phpt b/ext/gd/tests/bug37360.phpt
new file mode 100644 (file)
index 0000000..dce22e7
--- /dev/null
+++ b/ext/gd/tests/bug37360.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #37360 (gdimagecreatefromgif, bad image sizes)
+--SKIPIF--
+<?php 
+       if (!extension_loaded('gd')) die("skip gd extension not available\n"); 
+       if (!GD_BUNDLED) die('skip external GD libraries always fail');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(dirname(__FILE__) . '/bug37360.gif');
+var_dump($im);
+?>
+--EXPECTF--
+resource(%d) of type (gd)