MFH: Fixed bug #27293 (two crashes inside image2wbmp()).

diff --git a/NEWS b/NEWS
index ffb8e35ef484393beb70e2f5391d53f62c3e3601..0088192f7e6dee30344a598f67211f7b3958cd05 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Feb 2004, Version 4.3.5
+- Fixed bug #27293 (two crashes inside image2wbmp()). (Ilia)
 - Fixed bug #27278 (*printf() functions treat arguments as if passed by
   reference). (Ilia)
 - Fixed bug #26753 (zend_fetch_list_dtor_id() doesn't check NULL strings).

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 98d18bf1eb8bf8d3c53590caaa462ff9d50e9c4b..4e4084bd5786173d6e3c9a8fd0415e261e4a8c87 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1620,6 +1620,8 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char
                                if(q<0||q>255) {
                                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid threshold value '%d'. It must be between 0 and 255", q);
                                }
+                               gdImageWBMP(im, q, fp);
+                               break;
                        case PHP_GDIMG_TYPE_JPG:
                                (*func_p)(im, fp, q);
                                break;
@@ -1662,6 +1664,8 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char
                                if(q<0||q>255) {
                                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid threshold value '%d'. It must be between 0 and 255", q);
                                }
+                               gdImageWBMP(im, q, tmp);
+                               break;
                        case PHP_GDIMG_TYPE_JPG:
                                (*func_p)(im, tmp, q);
                                break;
@@ -3625,6 +3629,10 @@ static void _php_image_bw_convert( gdImagePtr im_org, gdIOCtx *out, int threshol
                return;
        }
 
+       if (im_org->trueColor) {
+               gdImageTrueColorToPalette(im_org, 1, 256);
+       }
+
        for (y = 0; y < dest_height; y++) {
                for (x = 0; x < dest_width; x++) {
                        color_org = gdImageGetPixel (im_org, x, y);