Upstream fix from https://bitbucket.org/libgd/gd-libgd/issue/75

diff --git a/ext/gd/libgd/gd_webp.c b/ext/gd/libgd/gd_webp.c
index 889f5f10a6e120f31bd980c6a22acd85d1ee4358..bf9ac9dd0e1a4a27d78bf29fb294b525acd2cc8b 100644 (file)
--- a/ext/gd/libgd/gd_webp.c
+++ b/ext/gd/libgd/gd_webp.c
@@ -58,11 +58,13 @@ gdImagePtr gdImageCreateFromWebpPtr (int size, void *data)
        return im;
 }
 
+#define GD_WEBP_ALLOC_STEP (4*1024)
+
 gdImagePtr gdImageCreateFromWebpCtx (gdIOCtx * infile)
 {
        int    width, height, ret;
-       unsigned char   *filedata;
-       unsigned char   dummy[1024];
+       unsigned char   *filedata = NULL;
+       unsigned char   *read, *temp;
        unsigned char   *Y = NULL;
        unsigned char   *U = NULL;
        unsigned char   *V = NULL;
@@ -70,16 +72,25 @@ gdImagePtr gdImageCreateFromWebpCtx (gdIOCtx * infile)
        gdImagePtr im;
 
        do {
-               n = gdGetBuf(dummy, 1024, infile);
-               size += n;
-       } while (n != EOF);
+               temp = gdRealloc(filedata, size+GD_WEBP_ALLOC_STEP);
+               if (temp) {
+                       filedata = temp;
+                       read = temp + size;
+               } else {
+                       if (filedata) {
+                               gdFree(filedata);
+                       }
+                       php_gd_error("WebP decode: realloc failed");
+                       return NULL;
+               }
+
+               n = gdGetBuf(read, GD_WEBP_ALLOC_STEP, infile);
+               /* differs from upstream where gdGetBuf return 0 instead of EOF */
+               if (n>0 && n!=EOF) {
+                       size += n;
+               }
+       } while (n>0 && n!=EOF);
 
-       filedata = gdMalloc(size);
-       if  (!filedata) {
-               php_gd_error("WebP decode: alloc failed");
-               return NULL;
-       }
-       gdGetBuf(filedata, size, infile);
        ret = WebPDecode(filedata, size, &Y, &U, &V, &width, &height);
        gdFree(filedata);
        if (ret != webp_success) {