MFH: Fixed bug #29349 (imagecreatefromstring() crashes with external GD

library).

diff --git a/NEWS b/NEWS
index 170c2d5ad7181fd00e069ca58bc7735dc74ca770..7c71198bfb56e656b79d61589d46a8890d6cd51a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ PHP 4                                                                      NEWS
   for doing performance stats without warnings in server-log. (Uwe Schindler)
 - Fixed bug #29369 (Uploaded files with ' or " in their names get their names
   truncated at those characters). (Ilia)
+- Fixed bug #29349 (imagecreatefromstring() crashes with external GD library).
+  (Ilia, adconrad at debian dot org)
 - Fixed bug #29333 (output_buffering+trans_sess_id can corrupt output). (Ilia)
 - Fixed bug #29226 (ctype_* functions missing validation of numeric string 
   representations). (Ilia)

diff --git a/ext/gd/config.m4 b/ext/gd/config.m4
index 461aa39f5286c92f8dbb80b9f649576511381fa4..ed0332cc62832b4fa92d50c894e8fa9ae9741b53 100644 (file)
--- a/ext/gd/config.m4
+++ b/ext/gd/config.m4
@@ -258,6 +258,7 @@ AC_DEFUN(PHP_GD_CHECK_VERSION,[
   PHP_CHECK_LIBRARY(gd, gdImageGifCtx,          [AC_DEFINE(HAVE_GD_GIF_CTX,          1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ])
   PHP_CHECK_LIBRARY(gd, gdCacheCreate,          [AC_DEFINE(HAVE_GD_CACHE_CREATE,     1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ])
   PHP_CHECK_LIBRARY(gd, gdFontCacheShutdown,    [AC_DEFINE(HAVE_GD_THREAD_SAFE,      1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ])
+  PHP_CHECK_LIBRARY(gd, gdNewDynamicCtxEx,      [AC_DEFINE(HAVE_GD_DYNAMIC_CTX_EX    1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ])
 ])
 
 dnl
@@ -307,6 +308,7 @@ dnl These are always available with bundled library
   AC_DEFINE(HAVE_GD_GIF_READ,         1, [ ])
   AC_DEFINE(HAVE_GD_GIF_CREATE,       1, [ ])
   AC_DEFINE(HAVE_GD_IMAGEELLIPSE,     1, [ ])
+  AC_DEFINE(HAVE_GD_DYNAMIC_CTX_EX,   1, [ ])
 
 dnl Make sure the libgd/ is first in the include path
   GDLIB_CFLAGS="-DHAVE_LIBPNG"

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index dfb478e2a8c9d262c8ea5809b068846643625cbe..21b78374baa4f398dd55bd0e385bb203e2b1faad 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -107,6 +107,10 @@ extern int gdImageColorResolve(gdImagePtr, int, int, int);
 int gdImageColorClosestHWB(gdImagePtr im, int r, int g, int b);
 #endif
 
+#ifndef HAVE_GD_DYNAMIC_CTX_EX
+#define gdNewDynamicCtxEx(len, data, val) gdNewDynamicCtx(len, data)
+#endif
+
 static gdImagePtr _php_image_create_from_string (zval **Data, char *tn, gdImagePtr (*ioctx_func_p)() TSRMLS_DC);
 static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type, char *tn, gdImagePtr (*func_p)(), gdImagePtr (*ioctx_func_p)());
 static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char *tn, void (*func_p)());
@@ -1242,7 +1246,7 @@ static int _php_image_type (char data[8])
 #ifdef HAVE_GD_WBMP
        else {
                gdIOCtx *io_ctx;
-               io_ctx = gdNewDynamicCtx (8, data);
+               io_ctx = gdNewDynamicCtxEx (8, data, 0);
                if (io_ctx) {
                        if (getmbi((int(*)(void*))gdGetC, io_ctx) == 0 && skipheader((int(*)(void*))gdGetC, io_ctx) == 0 ) {
 #if HAVE_LIBGD204
@@ -1274,7 +1278,7 @@ gdImagePtr _php_image_create_from_string(zval **data, char *tn, gdImagePtr (*ioc
        gdImagePtr im;
        gdIOCtx *io_ctx;
 
-       io_ctx = gdNewDynamicCtx (Z_STRLEN_PP(data), Z_STRVAL_PP(data));
+       io_ctx = gdNewDynamicCtxEx(Z_STRLEN_PP(data), Z_STRVAL_PP(data), 0);
 
        if (!io_ctx) {
                return NULL;
@@ -1428,7 +1432,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
                        goto out_err;
                }
 
-               io_ctx = gdNewDynamicCtx(buff_size, buff);
+               io_ctx = gdNewDynamicCtxEx(buff_size, buff, 0);
                if(!io_ctx) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING,"Cannot allocate GD IO context");
                        goto out_err;