From 7456da1533d01e0483d0154561e777f701d1c736 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Tue, 27 Jul 2004 00:27:10 +0000 Subject: [PATCH] MFH: Fixed bug #29349 (imagecreatefromstring() crashes with external GD library). --- NEWS | 2 ++ ext/gd/config.m4 | 2 ++ ext/gd/gd.c | 10 +++++++--- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/NEWS b/NEWS index 170c2d5ad7..7c71198bfb 100644 --- a/NEWS +++ b/NEWS @@ -6,6 +6,8 @@ PHP 4 NEWS for doing performance stats without warnings in server-log. (Uwe Schindler) - Fixed bug #29369 (Uploaded files with ' or " in their names get their names truncated at those characters). (Ilia) +- Fixed bug #29349 (imagecreatefromstring() crashes with external GD library). + (Ilia, adconrad at debian dot org) - Fixed bug #29333 (output_buffering+trans_sess_id can corrupt output). (Ilia) - Fixed bug #29226 (ctype_* functions missing validation of numeric string representations). (Ilia) diff --git a/ext/gd/config.m4 b/ext/gd/config.m4 index 461aa39f52..ed0332cc62 100644 --- a/ext/gd/config.m4 +++ b/ext/gd/config.m4 @@ -258,6 +258,7 @@ AC_DEFUN(PHP_GD_CHECK_VERSION,[ PHP_CHECK_LIBRARY(gd, gdImageGifCtx, [AC_DEFINE(HAVE_GD_GIF_CTX, 1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ]) PHP_CHECK_LIBRARY(gd, gdCacheCreate, [AC_DEFINE(HAVE_GD_CACHE_CREATE, 1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ]) PHP_CHECK_LIBRARY(gd, gdFontCacheShutdown, [AC_DEFINE(HAVE_GD_THREAD_SAFE, 1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ]) + PHP_CHECK_LIBRARY(gd, gdNewDynamicCtxEx, [AC_DEFINE(HAVE_GD_DYNAMIC_CTX_EX 1, [ ])], [], [ -L$GD_LIB $GD_SHARED_LIBADD ]) ]) dnl @@ -307,6 +308,7 @@ dnl These are always available with bundled library AC_DEFINE(HAVE_GD_GIF_READ, 1, [ ]) AC_DEFINE(HAVE_GD_GIF_CREATE, 1, [ ]) AC_DEFINE(HAVE_GD_IMAGEELLIPSE, 1, [ ]) + AC_DEFINE(HAVE_GD_DYNAMIC_CTX_EX, 1, [ ]) dnl Make sure the libgd/ is first in the include path GDLIB_CFLAGS="-DHAVE_LIBPNG" diff --git a/ext/gd/gd.c b/ext/gd/gd.c index dfb478e2a8..21b78374ba 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -107,6 +107,10 @@ extern int gdImageColorResolve(gdImagePtr, int, int, int); int gdImageColorClosestHWB(gdImagePtr im, int r, int g, int b); #endif +#ifndef HAVE_GD_DYNAMIC_CTX_EX +#define gdNewDynamicCtxEx(len, data, val) gdNewDynamicCtx(len, data) +#endif + static gdImagePtr _php_image_create_from_string (zval **Data, char *tn, gdImagePtr (*ioctx_func_p)() TSRMLS_DC); static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type, char *tn, gdImagePtr (*func_p)(), gdImagePtr (*ioctx_func_p)()); static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char *tn, void (*func_p)()); @@ -1242,7 +1246,7 @@ static int _php_image_type (char data[8]) #ifdef HAVE_GD_WBMP else { gdIOCtx *io_ctx; - io_ctx = gdNewDynamicCtx (8, data); + io_ctx = gdNewDynamicCtxEx (8, data, 0); if (io_ctx) { if (getmbi((int(*)(void*))gdGetC, io_ctx) == 0 && skipheader((int(*)(void*))gdGetC, io_ctx) == 0 ) { #if HAVE_LIBGD204 @@ -1274,7 +1278,7 @@ gdImagePtr _php_image_create_from_string(zval **data, char *tn, gdImagePtr (*ioc gdImagePtr im; gdIOCtx *io_ctx; - io_ctx = gdNewDynamicCtx (Z_STRLEN_PP(data), Z_STRVAL_PP(data)); + io_ctx = gdNewDynamicCtxEx(Z_STRLEN_PP(data), Z_STRVAL_PP(data), 0); if (!io_ctx) { return NULL; @@ -1428,7 +1432,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type, goto out_err; } - io_ctx = gdNewDynamicCtx(buff_size, buff); + io_ctx = gdNewDynamicCtxEx(buff_size, buff, 0); if(!io_ctx) { php_error_docref(NULL TSRMLS_CC, E_WARNING,"Cannot allocate GD IO context"); goto out_err; -- 2.40.0