MFH: Fixed bug #29349 (imagecreatefromstring() crashes with external GD

library).

diff --git a/ext/gd/config.m4 b/ext/gd/config.m4
index 5c24407f4f8641e5ac45924f6475727dda5d2c8e..78571afad1b037b9973853c3a6d02043d51a89a6 100644 (file)
--- a/ext/gd/config.m4
+++ b/ext/gd/config.m4
@@ -259,6 +259,7 @@ AC_DEFUN(PHP_GD_CHECK_VERSION,[
   PHP_CHECK_LIBRARY(gd, gdImageGifCtx,          [AC_DEFINE(HAVE_GD_GIF_CTX,          1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ])
   PHP_CHECK_LIBRARY(gd, gdCacheCreate,          [AC_DEFINE(HAVE_GD_CACHE_CREATE,     1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ])
   PHP_CHECK_LIBRARY(gd, gdFontCacheShutdown,    [AC_DEFINE(HAVE_GD_THREAD_SAFE,      1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ])
+  PHP_CHECK_LIBRARY(gd, gdNewDynamicCtxEx,      [AC_DEFINE(HAVE_GD_DYNAMIC_CTX_EX    1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ])
 ])
 
 dnl
@@ -308,6 +309,7 @@ dnl These are always available with bundled library
   AC_DEFINE(HAVE_GD_GIF_READ,         1, [ ])
   AC_DEFINE(HAVE_GD_GIF_CREATE,       1, [ ])
   AC_DEFINE(HAVE_GD_IMAGEELLIPSE,     1, [ ])
+  AC_DEFINE(HAVE_GD_DYNAMIC_CTX_EX,   1, [ ])
 
 dnl Make sure the libgd/ is first in the include path
   GDLIB_CFLAGS="-DHAVE_LIBPNG"

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 8cb6e5e1b922dd2d3f3e46704daaaa065e2927b0..8694e471afab6b59db1cd8b6bc2073152e152dcf 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -115,6 +115,10 @@ extern int gdImageColorResolve(gdImagePtr, int, int, int);
 int gdImageColorClosestHWB(gdImagePtr im, int r, int g, int b);
 #endif
 
+#ifndef HAVE_GD_DYNAMIC_CTX_EX
+#define gdNewDynamicCtxEx(len, data, val) gdNewDynamicCtx(len, data)
+#endif
+
 /* Section Filters Declarations */
 /* IMPORTANT NOTE FOR NEW FILTER
  * Do not forget to update:
@@ -1343,7 +1347,7 @@ static int _php_image_type (char data[8])
 #ifdef HAVE_GD_WBMP
        else {
                gdIOCtx *io_ctx;
-               io_ctx = gdNewDynamicCtx(8, data);
+               io_ctx = gdNewDynamicCtxEx(8, data, 0);
                if (io_ctx) {
                        if (getmbi((int(*)(void *)) gdGetC, io_ctx) == 0 && skipheader((int(*)(void *)) gdGetC, io_ctx) == 0 ) {
 #if HAVE_LIBGD204
@@ -1375,7 +1379,7 @@ gdImagePtr _php_image_create_from_string(zval **data, char *tn, gdImagePtr (*ioc
        gdImagePtr im;
        gdIOCtx *io_ctx;
 
-       io_ctx = gdNewDynamicCtx (Z_STRLEN_PP(data), Z_STRVAL_PP(data));
+       io_ctx = gdNewDynamicCtxEx(Z_STRLEN_PP(data), Z_STRVAL_PP(data), 0);
 
        if (!io_ctx) {
                return NULL;
@@ -1530,7 +1534,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
                        goto out_err;
                }
 
-               io_ctx = gdNewDynamicCtx(buff_size, buff);
+               io_ctx = gdNewDynamicCtxEx(buff_size, buff, 0);
                if (!io_ctx) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING,"Cannot allocate GD IO context");
                        goto out_err;