From: Christoph M. Becker <cmbecker69@gmx.de>
Date: Sat, 24 Sep 2016 09:28:20 +0000 (+0200)
Subject: Fix #73159: imagegd2(): unrecognized formats may result in corrupted files
X-Git-Tag: php-7.0.12RC1~14^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=709731797c55b373329201e9d3c9221303d7faa2;p=php

Fix #73159: imagegd2(): unrecognized formats may result in corrupted files

We must not apply the format correction twice for truecolor images.
---

diff --git a/NEWS b/NEWS
index c0cefbae20..a7a71846bb 100644
--- a/NEWS
+++ b/NEWS
@@ -28,6 +28,8 @@ PHP                                                                        NEWS
     (Mark Plomer, cmb)
   . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb)
   . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb)
+  . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted
+    files). (cmb)
 
 - Mbstring:
   . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb)
diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c
index 3b4dfbe098..57d5844510 100644
--- a/ext/gd/libgd/gd_gd2.c
+++ b/ext/gd/libgd/gd_gd2.c
@@ -670,7 +670,7 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)
 
 	/* Force fmt to a valid value since we don't return anything. */
 	if ((fmt != GD2_FMT_RAW) && (fmt != GD2_FMT_COMPRESSED)) {
-		fmt = im->trueColor ? GD2_FMT_TRUECOLOR_COMPRESSED : GD2_FMT_COMPRESSED;
+		fmt = GD2_FMT_COMPRESSED;
 	}
 	if (im->trueColor) {
 		fmt += 2;
diff --git a/ext/gd/tests/bug73159.phpt b/ext/gd/tests/bug73159.phpt
new file mode 100644
index 0000000000..4889ffb6fd
--- /dev/null
+++ b/ext/gd/tests/bug73159.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #73159 (imagegd2(): unrecognized formats may result in corrupted files)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+
+ob_start();
+imagegd2($im, null, 128, 0);
+$buffer = ob_get_clean();
+
+$header = unpack('@12/nformat', $buffer);
+printf("format: %d\n", $header['format']);
+?>
+===DONE===
+--EXPECT--
+format: 4
+===DONE===