- Fix #28984, using full transparent segfauls in imagefill

  (NB: imagefill is broken in HEAD, same code)
- Add testcase

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 3eb846cee11c1cbfc27b3c3e24590f399502c679..4ee4a442fcfd6a79dbf75b08ef8f3a5b48f1b5c5 100644 (file)
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1879,13 +1879,18 @@ void gdImageFill(gdImagePtr im, int x, int y, int nc)
        int l, x1, x2, dy;
        int oc;   /* old pixel value */
        int wx2,wy2;
+       int alphablending_bak;
        /* stack of filled segments */
        /* struct seg stack[FILL_MAX],*sp = stack;; */
        struct seg *stack;
        struct seg *sp;
 
+       alphablending_bak = im->alphaBlendingFlag;      
+       im->alphaBlendingFlag = 0;
+
        if (nc==gdTiled){
                _gdImageFillTiled(im,x,y,nc);
+               im->alphaBlendingFlag = alphablending_bak;      
                return;
        }
 
@@ -1931,6 +1936,7 @@ skip:                     for (x++; x<=x2 && (gdImageGetPixel(im, x, y)!=oc); x++);
                } while (x<=x2);
        }
        efree(stack);
+       im->alphaBlendingFlag = alphablending_bak;      
 }
 
 void _gdImageFillTiled(gdImagePtr im, int x, int y, int nc)

diff --git a/ext/gd/tests/bug28984.phpt b/ext/gd/tests/bug28984.phpt
new file mode 100644 (file)
index 0000000..24b501a
--- /dev/null
+++ b/ext/gd/tests/bug28984.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #28984 (imagefill segfault using a transparent color).
+--SKIPIF--
+<?php 
+       if (!extension_loaded('gd')) {  
+               die("skip gd extension not available\n");
+       }
+       if (!GD_BUNDLED) {
+               die('skip external GD libraries may fail');
+       }
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(100,100);
+imagealphablending($im, false);
+#$alpha = imagecolorallocatealpha($im, 255, 0, 255,0);
+$alpha = imagecolorallocate($im, 255, 0, 0);
+imagefill($im, 2, 2, $alpha);
+#imagesavealpha($im, true);
+imagepng($im, '1.png');
+imagedestroy($im);
+echo "Done\n";
+?>
+--EXPECT--
+Done