From: Remi Collet <remi@php.net>
Date: Mon, 3 Jun 2013 13:01:48 +0000 (+0200)
Subject: Fixed Bug #64962 	imagerotate produce corrupted image
X-Git-Tag: php-5.5.0RC3~8
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3579e81200927b75b2c5f353e016ec26d8884c26;p=php

Fixed Bug #64962 	imagerotate produce corrupted image

See https://bitbucket.org/libgd/gd-libgd/issue/67/problem-with-gdrotate

This computation need to be done in signed range.
---

diff --git a/NEWS b/NEWS
index c09b009c7b..25e3b205bb 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,7 @@ PHP                                                                        NEWS
 
 - GD:
   . Fixed Bug #64961 (segfault in imagesetinterpolation). (Remi)
+  . Fixed Bug #64962 (imagerotate produces corrupted image). (Remi)
 
 - Hash:
   . Fixed Bug #64745 (hash_pbkdf2() truncates data when using default length
diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c
index bcd76e9707..9652a3a18a 100644
--- a/ext/gd/libgd/gd_interpolation.c
+++ b/ext/gd/libgd/gd_interpolation.c
@@ -1690,8 +1690,8 @@ gdImagePtr gdImageRotateNearestNeighbour(gdImagePtr src, const float degrees, co
 		unsigned int j;
 		dst_offset_x = 0;
 		for (j = 0; j < new_width; j++) {
-			gdFixed f_i = gd_itofx(i - new_height/2);
-			gdFixed f_j = gd_itofx(j-new_width/2);
+			gdFixed f_i = gd_itofx((int)i - (int)new_height/2);
+			gdFixed f_j = gd_itofx((int)j - (int)new_width/2);
 			gdFixed f_m = gd_mulfx(f_j,f_sin) + gd_mulfx(f_i,f_cos) + f_0_5 + f_H;
 			gdFixed f_n = gd_mulfx(f_j,f_cos) - gd_mulfx(f_i,f_sin) + f_0_5 + f_W;
 			long m = gd_fxtoi(f_m);
@@ -1753,8 +1753,8 @@ gdImagePtr gdImageRotateGeneric(gdImagePtr src, const float degrees, const int b
 		unsigned int j;
 		dst_offset_x = 0;
 		for (j = 0; j < new_width; j++) {
-			gdFixed f_i = gd_itofx(i - new_height/ 2);
-			gdFixed f_j = gd_itofx(j  -new_width / 2);
+			gdFixed f_i = gd_itofx((int)i - (int)new_height/ 2);
+			gdFixed f_j = gd_itofx((int)j - (int)new_width / 2);
 			gdFixed f_m = gd_mulfx(f_j,f_sin) + gd_mulfx(f_i,f_cos) + f_0_5 + f_H;
 			gdFixed f_n = gd_mulfx(f_j,f_cos) - gd_mulfx(f_i,f_sin) + f_0_5 + f_W;
 			long m = gd_fxtoi(f_m);
@@ -1814,8 +1814,8 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 		dst_offset_x = 0;
 
 		for (j=0; j < new_width; j++) {
-			const gdFixed f_i = gd_itofx(i-new_height/2);
-			const gdFixed f_j = gd_itofx(j-new_width/2);
+			const gdFixed f_i = gd_itofx((int)i - (int)new_height/2);
+			const gdFixed f_j = gd_itofx((int)j - (int)new_width/2);
 			const gdFixed f_m = gd_mulfx(f_j,f_sin) + gd_mulfx(f_i,f_cos) + f_0_5 + f_H;
 			const gdFixed f_n = gd_mulfx(f_j,f_cos) - gd_mulfx(f_i,f_sin) + f_0_5 + f_W;
 			const unsigned int m = gd_fxtoi(f_m);
@@ -1941,8 +1941,8 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 		dst_offset_x = 0;
 
 		for (j=0; j < new_width; j++) {
-			const gdFixed f_i = gd_itofx(i-new_height/2);
-			const gdFixed f_j = gd_itofx(j-new_width/2);
+			const gdFixed f_i = gd_itofx((int)i - (int)new_height/2);
+			const gdFixed f_j = gd_itofx((int)j - (int)new_width/2);
 			const gdFixed f_m = gd_mulfx(f_j,f_sin) + gd_mulfx(f_i,f_cos) + f_0_5 + f_H;
 			const gdFixed f_n = gd_mulfx(f_j,f_cos) - gd_mulfx(f_i,f_sin) + f_0_5 + f_W;
 			const int m = gd_fxtoi(f_m);