Fixed bug #27293 (two crashes inside image2wbmp()).

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index d43c7e625cef661ec0d484859d77901dbea3cb11..1ce674e2d5614ca0dbc3d93304f91b0135d0f6e8 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1724,6 +1724,8 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char
                                if (q < 0 || q > 255) {
                                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid threshold value '%d'. It must be between 0 and 255", q);
                                }
+                               gdImageWBMP(im, q, fp);
+                               break;
                        case PHP_GDIMG_TYPE_JPG:
                                (*func_p)(im, fp, q);
                                break;
@@ -1766,6 +1768,8 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char
                                if (q < 0 || q > 255) {
                                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid threshold value '%d'. It must be between 0 and 255", q);
                                }
+                               gdImageWBMP(im, q, tmp);
+                               break;
                        case PHP_GDIMG_TYPE_JPG:
                                (*func_p)(im, tmp, q);
                                break;
@@ -3741,6 +3745,10 @@ static void _php_image_bw_convert(gdImagePtr im_org, gdIOCtx *out, int threshold
                return;
        }
 
+       if (im_org->trueColor) {
+               gdImageTrueColorToPalette(im_org, 1, 256);
+       }
+
        for (y = 0; y < dest_height; y++) {
                for (x = 0; x < dest_width; x++) {
                        color_org = gdImageGetPixel(im_org, x, y);