From fc898ee0f94ee3686aa1f359d4a973d5e8e1754b Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Fri, 21 Jun 2013 14:11:04 +0200 Subject: [PATCH] Fixed Bug #65060 imagecreatefrom... crashes with user streams Fixed Bug #65084 imagecreatefromjpeg fails with URL Regression introduced in 8a90aad (drop of USE_GD_IOCTX) Secure with php_stream_can_cast to avoid segfault in php_stream_cast. (encountered when imagecreatefromxpm with URL) --- NEWS | 2 ++ ext/gd/gd.c | 5 ++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/NEWS b/NEWS index d8b74c2b9a..577d2e40a4 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,8 @@ PHP NEWS - GD . Fixed #65070 (bgcolor does not use the same format as the input image with imagerotate). (Pierre) + . Fixed Bug #65060 (imagecreatefrom... crashes with user streams). (Remi) + . Fixed Bug #65084 (imagecreatefromjpeg fails with URL). (Remi) 20 Jun 2013, PHP 5.5.0 diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 4ebac94fcb..21aa9e2727 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -2361,13 +2361,12 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type, } } + stream = php_stream_open_wrapper(file, "rb", REPORT_ERRORS|IGNORE_PATH|IGNORE_URL_WIN, NULL); if (stream == NULL) { RETURN_FALSE; } - ioctx_func_p = NULL; /* don't allow sockets without IOCtx */ - if (image_type == PHP_GDIMG_TYPE_WEBP) { size_t buff_size; char *buff; @@ -2419,7 +2418,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type, io_ctx->gd_free(io_ctx); pefree(buff, 1); } - else { + else if (php_stream_can_cast(stream, PHP_STREAM_AS_STDIO)) { /* try and force the stream to be FILE* */ if (FAILURE == php_stream_cast(stream, PHP_STREAM_AS_STDIO | PHP_STREAM_CAST_TRY_HARD, (void **) &fp, REPORT_ERRORS)) { goto out_err; -- 2.50.1