diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2016-09-24 11:31:11 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2016-09-24 11:31:54 +0200 |
| commit | 61722743f455743b096f38c5f9e6944aa00dcd6a (patch) | |
| tree | 808f4cf1a1d41c37ee8927cd07985ccff23dce3c | |
| parent | 0a4b72fa940ff3d31f53e75e5b83b14ceb23a449 (diff) | |
| parent | 709731797c55b373329201e9d3c9221303d7faa2 (diff) | |
| download | php-git-61722743f455743b096f38c5f9e6944aa00dcd6a.tar.gz | |
Merge branch 'PHP-5.6' into PHP-7.0
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/gd/libgd/gd_gd2.c | 2 | ||||
| -rw-r--r-- | ext/gd/tests/bug73159.phpt | 21 |
3 files changed, 24 insertions, 1 deletions
@@ -32,6 +32,8 @@ PHP NEWS (Mark Plomer, cmb) . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb) . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb) + . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted + files). (cmb) - Mbstring: . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb) diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c index 3b4dfbe098..57d5844510 100644 --- a/ext/gd/libgd/gd_gd2.c +++ b/ext/gd/libgd/gd_gd2.c @@ -670,7 +670,7 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt) /* Force fmt to a valid value since we don't return anything. */ if ((fmt != GD2_FMT_RAW) && (fmt != GD2_FMT_COMPRESSED)) { - fmt = im->trueColor ? GD2_FMT_TRUECOLOR_COMPRESSED : GD2_FMT_COMPRESSED; + fmt = GD2_FMT_COMPRESSED; } if (im->trueColor) { fmt += 2; diff --git a/ext/gd/tests/bug73159.phpt b/ext/gd/tests/bug73159.phpt new file mode 100644 index 0000000000..4889ffb6fd --- /dev/null +++ b/ext/gd/tests/bug73159.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #73159 (imagegd2(): unrecognized formats may result in corrupted files) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$im = imagecreatetruecolor(10, 10); + +ob_start(); +imagegd2($im, null, 128, 0); +$buffer = ob_get_clean(); + +$header = unpack('@12/nformat', $buffer); +printf("format: %d\n", $header['format']); +?> +===DONE=== +--EXPECT-- +format: 4 +===DONE=== |