From: Christoph M. Becker <cmbecker69@gmx.de>
Date: Fri, 23 Sep 2016 22:46:35 +0000 (+0200)
Subject: Fix #73155: imagegd2() writes wrong chunk sizes on boundaries
X-Git-Tag: php-7.0.12RC1~15^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c7936ead8fbe87a55e7c17f9449c2704acd810a3;p=php

Fix #73155: imagegd2() writes wrong chunk sizes on boundaries
---

diff --git a/NEWS b/NEWS
index b9ef512bd2..c0cefbae20 100644
--- a/NEWS
+++ b/NEWS
@@ -27,6 +27,7 @@ PHP                                                                        NEWS
   . Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
     (Mark Plomer, cmb)
   . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb)
+  . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb)
 
 - Mbstring:
   . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb)
diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c
index e954aafa68..3b4dfbe098 100644
--- a/ext/gd/libgd/gd_gd2.c
+++ b/ext/gd/libgd/gd_gd2.c
@@ -689,8 +689,8 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)
 	}
 
 	/* Work out number of chunks. */
-	ncx = im->sx / cs + 1;
-	ncy = im->sy / cs + 1;
+	ncx = (im->sx + cs - 1) / cs;
+	ncy = (im->sy + cs - 1) / cs;
 
 	/* Write the standard header. */
 	_gd2PutHeader (im, out, cs, fmt, ncx, ncy);
diff --git a/ext/gd/tests/bug73155.phpt b/ext/gd/tests/bug73155.phpt
new file mode 100644
index 0000000000..dc1791e565
--- /dev/null
+++ b/ext/gd/tests/bug73155.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Bug #73155 (imagegd2() writes wrong chunk sizes on boundaries)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(64, 64);
+imagecolorallocate($im, 0, 0, 0);
+
+ob_start();
+imagegd2($im, null, 64, IMG_GD2_RAW);
+$buffer = ob_get_clean();
+
+$header = unpack('@10/nchunk_size/nformat/nx_count/ny_count', $buffer);
+printf("chunk size: %d\n", $header['chunk_size']);
+printf("x chunk count: %d\n", $header['x_count']);
+printf("y chunk count: %d\n", $header['y_count']);
+printf("file size: %d\n", strlen($buffer));
+?>
+===DONE===
+--EXPECT--
+chunk size: 64
+x chunk count: 1
+y chunk count: 1
+file size: 5145
+===DONE===