From: Christoph M. Becker <cmb@php.net>
Date: Mon, 13 Jul 2015 13:43:16 +0000 (+0200)
Subject: Fix #69024: imagescale segfault with palette based image
X-Git-Tag: php-7.1.1RC1~35^2~11
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bccbd2df218f5a36650581506c4306a58a157cb2;p=php

Fix #69024: imagescale segfault with palette based image

imagescale(..., IMG_BICUBIC) is not supposed to work with palette images, so we
fix that by converting to true color if necessary. Basically the same fix has
already been applied to the external libgd[1].

[1] <https://github.com/libgd/libgd/commit/723ea520bed3b5854df87393c687323d3930edf3>
---

diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c
index ed2fc188f9..e2c9f05306 100644
--- a/ext/gd/libgd/gd_interpolation.c
+++ b/ext/gd/libgd/gd_interpolation.c
@@ -1059,6 +1059,11 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 	gdImagePtr tmp_im;
 	gdImagePtr dst;
 
+	/* Convert to truecolor if it isn't; this code requires it. */
+	if (!src->trueColor) {
+		gdImagePaletteToTrueColor(src);
+	}
+
 	tmp_im = gdImageCreateTrueColor(new_width, src_height);
 	if (tmp_im == NULL) {
 		return NULL;
diff --git a/ext/gd/tests/bug69024.phpt b/ext/gd/tests/bug69024.phpt
new file mode 100644
index 0000000000..f2113fc44f
--- /dev/null
+++ b/ext/gd/tests/bug69024.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #69024 (imagescale segfault with palette based image)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(256, 256);
+imagescale($im, 32, 32, IMG_BICUBIC);
+imagedestroy($im);
+echo "done\n";
+?>
+--EXPECT--
+done