MFH: Fixed bug #30281 (Prevent non-wbmp images from being detected as such)

diff --git a/NEWS b/NEWS
index 4d8f3595ed0147b763a2d3c148ead70a03ffd07e..df4a33b6a72c908811e5020575473d94c20887d8 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,8 +3,10 @@ PHP 4                                                                      NEWS
 ?? ??? 2004, Version 4.3.10
 - Backported Marcus' foreach() speedup patch from PHP 5.x. (Derick)
 - Fixed potential problems with unserializing invalid serialize data. (Marcus)
-- Fixed bug #30282 (segfault when using unknown/unsupported session.save_handler 
-  and/or session.serialize_handler). (Tony)
+- Fixed bug #30282 (segfault when using unknown/unsupported
+  session.save_handler and/or session.serialize_handler). (Tony)
+- Fixed bug #30281 (Prevent non-wbmp images from being detected as such).
+  (Ilia)
 - Fixed bug #30276 (Possible crash in ctype_digit on large numbers). (Ilia)
 - Fixed bug #30224 (Sybase date strings are sometimes not null terminated).
   (Ilia)

diff --git a/ext/standard/image.c b/ext/standard/image.c
index b0782e3780648a77c168eb41b65c72425677cbdc..0655efb8213cd51b53e5e273580e30423d93247a 100644 (file)
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -942,7 +942,7 @@ static int php_get_wbmp(php_stream *stream, struct gfxinfo **result, int check T
        } while (i & 0x80);
 
        /* maximum valid sizes for wbmp (although 127x127 may be a more accurate one) */
-       if (height > 2048 || width > 2048) {
+       if (!height || !width || height > 2048 || width > 2048) {
                return 0;
        }