- MFH: #37346, invalid colormap format

- MFH: #37360, bad gif size

diff --git a/NEWS b/NEWS
index 2df58295515b2ee65e9fdd65488cc974d53a695b..d086eab1b5e415f6e8e2c67594ef445da022c08e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,7 +4,9 @@ PHP 4                                                                      NEWS
 - Updated PCRE to version 6.6. (Andrei)
 - Added overflow checks to wordwrap() function. (Ilia)
 - Added a check for special characters in the session name. (Ilia)
+- Fixed bug #34360 (bad gif size) (Pierre)
 - Fixed bug #37348 (make PEAR install ignore open_basedir). (Ilia)
+- Fixed bug #37346 (invalid colormap format) (Pierre)
 - Fixed bug #37162 (wddx does not build as a shared extension).  
   (jdolecek at NetBSD dot org, Ilia)
 - Fixed bug #37046 (foreach breaks static scope). (Dmitry)

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index e8817d77209fa99edfbb64d08ffab283381a67f2..092c89a5d86d8f3ba014bf39a91123c60df767fd 100644 (file)
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -147,7 +147,10 @@ gdImageCreateFromGifCtx(gdIOCtxPtr fd)
        Background      = buf[5];
        AspectRatio     = buf[6];
 
-       if (BitSet(buf[4], LOCALCOLORMAP)) {    /* Global Colormap */
+               imw = LM_to_uint(buf[0],buf[1]);
+               imh = LM_to_uint(buf[2],buf[3]);
+
+               if (BitSet(buf[4], LOCALCOLORMAP)) {    /* Global Colormap */
                if (ReadColorMap(fd, BitPixel, ColorMap)) {
                        return 0;
                }
@@ -182,16 +185,17 @@ gdImageCreateFromGifCtx(gdIOCtxPtr fd)
 
                bitPixel = 1<<((buf[8]&0x07)+1);
 
-               imw = LM_to_uint(buf[4],buf[5]);
-               imh = LM_to_uint(buf[6],buf[7]);
+                          if (!useGlobalColormap) {
+                                  if (ReadColorMap(fd, bitPixel, localColorMap)) {
+                                          return 0;
+                                  }
+                          }
+                          
               if (!(im = gdImageCreate(imw, imh))) {
                         return 0;
               }
                im->interlace = BitSet(buf[8], INTERLACE);
                if (! useGlobalColormap) {
-                       if (ReadColorMap(fd, bitPixel, localColorMap)) { 
-                                 return 0;
-                       }
                        ReadImage(im, fd, imw, imh, localColorMap, 
                                  BitSet(buf[8], INTERLACE)); 
                                  /*1.4//imageCount != imageNumber); */

diff --git a/ext/gd/tests/bug37346.gif b/ext/gd/tests/bug37346.gif
new file mode 100644 (file)
index 0000000..76ce1e3
--- /dev/null
+++ b/ext/gd/tests/bug37346.gif
@@ -0,0 +1,4 @@
+GIF89a\r
+<\r
+\r
+¿´°É, ÎÒ¶¼Ëµ¹ýÂ˲»ÑÏÁË
\ No newline at end of file

diff --git a/ext/gd/tests/bug37346.phpt b/ext/gd/tests/bug37346.phpt
new file mode 100644 (file)
index 0000000..4677a1a
--- /dev/null
+++ b/ext/gd/tests/bug37346.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #37346 (gdimagecreatefromgif, bad colormap)
+--SKIPIF--
+<?php 
+       if (!extension_loaded('gd')) die("skip gd extension not available\n"); 
+       if (!GD_BUNDLED) die('skip external GD libraries always fail');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(dirname(__FILE__) . '/bug37346.gif');
+?>
+--EXPECTF--
+Warning: imagecreatefromgif() [%s]: '%sbug37346.gif' is not a valid GIF file in %sbug37346.php on line %d

diff --git a/ext/gd/tests/bug37360.gif b/ext/gd/tests/bug37360.gif
new file mode 100644 (file)
index 0000000..3f9e6c5
Binary files /dev/null and b/ext/gd/tests/bug37360.gif differ

diff --git a/ext/gd/tests/bug37360.phpt b/ext/gd/tests/bug37360.phpt
new file mode 100644 (file)
index 0000000..dce22e7
--- /dev/null
+++ b/ext/gd/tests/bug37360.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #37360 (gdimagecreatefromgif, bad image sizes)
+--SKIPIF--
+<?php 
+       if (!extension_loaded('gd')) die("skip gd extension not available\n"); 
+       if (!GD_BUNDLED) die('skip external GD libraries always fail');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(dirname(__FILE__) . '/bug37360.gif');
+var_dump($im);
+?>
+--EXPECTF--
+resource(%d) of type (gd)