diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2016-09-24 11:28:20 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2016-09-24 11:28:20 +0200 |
| commit | 709731797c55b373329201e9d3c9221303d7faa2 (patch) | |
| tree | 756f5dc1d4dbe0016226587f41a852bfeac7df9e | |
| parent | c7936ead8fbe87a55e7c17f9449c2704acd810a3 (diff) | |
| download | php-git-709731797c55b373329201e9d3c9221303d7faa2.tar.gz | |
Fix #73159: imagegd2(): unrecognized formats may result in corrupted files
We must not apply the format correction twice for truecolor images.
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/gd/libgd/gd_gd2.c | 2 | ||||
| -rw-r--r-- | ext/gd/tests/bug73159.phpt | 21 |
3 files changed, 24 insertions, 1 deletions
@@ -28,6 +28,8 @@ PHP NEWS (Mark Plomer, cmb) . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb) . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb) + . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted + files). (cmb) - Mbstring: . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb) diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c index 3b4dfbe098..57d5844510 100644 --- a/ext/gd/libgd/gd_gd2.c +++ b/ext/gd/libgd/gd_gd2.c @@ -670,7 +670,7 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt) /* Force fmt to a valid value since we don't return anything. */ if ((fmt != GD2_FMT_RAW) && (fmt != GD2_FMT_COMPRESSED)) { - fmt = im->trueColor ? GD2_FMT_TRUECOLOR_COMPRESSED : GD2_FMT_COMPRESSED; + fmt = GD2_FMT_COMPRESSED; } if (im->trueColor) { fmt += 2; diff --git a/ext/gd/tests/bug73159.phpt b/ext/gd/tests/bug73159.phpt new file mode 100644 index 0000000000..4889ffb6fd --- /dev/null +++ b/ext/gd/tests/bug73159.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #73159 (imagegd2(): unrecognized formats may result in corrupted files) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$im = imagecreatetruecolor(10, 10); + +ob_start(); +imagegd2($im, null, 128, 0); +$buffer = ob_get_clean(); + +$header = unpack('@12/nformat', $buffer); +printf("format: %d\n", $header['format']); +?> +===DONE=== +--EXPECT-- +format: 4 +===DONE=== |