diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-01-06 13:24:07 +0100 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-01-06 13:25:11 +0100 |
| commit | be0b94c220c666752806235a82b364fc023b06b7 (patch) | |
| tree | 034e6fd00c0c77e94ded94e662fe6a2a69760d6f /ext/gd | |
| parent | 0b4da7e6da1b335d87a64b3b82dd5f2001bfdffc (diff) | |
| download | php-git-be0b94c220c666752806235a82b364fc023b06b7.tar.gz | |
Fix hypothetical segfault in gdTransformAffineCopy()
This has been reported to upstream[1], but since ext/gd never calls
`gdTransformAffineCopy()` for a palette image, it is not a bug for PHP.
Therefore we apply the fix to master only.
[1] <https://github.com/libgd/libgd/issues/586>
Diffstat (limited to 'ext/gd')
| -rw-r--r-- | ext/gd/libgd/gd_interpolation.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c index 698e407fbf..6ea81ea61c 100644 --- a/ext/gd/libgd/gd_interpolation.c +++ b/ext/gd/libgd/gd_interpolation.c @@ -2302,7 +2302,6 @@ int gdTransformAffineCopy(gdImagePtr dst, int backup_clipx1, backup_clipy1, backup_clipx2, backup_clipy2; register int x, y, src_offset_x, src_offset_y; double inv[6]; - int *dst_p; gdPointF pt, src_pt; gdRect bbox; int end_x, end_y; @@ -2365,11 +2364,18 @@ int gdTransformAffineCopy(gdImagePtr dst, } } else { for (y = 0; y <= end_y; y++) { + unsigned char *dst_p = NULL; + int *tdst_p = NULL; + pt.y = y + 0.5 + bbox.y; if ((dst_y + y) < 0 || ((dst_y + y) > gdImageSY(dst) -1)) { continue; } - dst_p = dst->tpixels[dst_y + y] + dst_x; + if (dst->trueColor) { + tdst_p = dst->tpixels[dst_y + y] + dst_x; + } else { + dst_p = dst->pixels[dst_y + y] + dst_x; + } for (x = 0; x <= end_x; x++) { pt.x = x + 0.5 + bbox.x; @@ -2378,7 +2384,11 @@ int gdTransformAffineCopy(gdImagePtr dst, if ((dst_x + x) < 0 || (dst_x + x) > (gdImageSX(dst) - 1)) { break; } - *(dst_p++) = getPixelInterpolated(src, src_offset_x + src_pt.x, src_offset_y + src_pt.y, -1); + if (dst->trueColor) { + *(tdst_p++) = getPixelInterpolated(src, src_offset_x + src_pt.x, src_offset_y + src_pt.y, -1); + } else { + *(dst_p++) = getPixelInterpolated(src, src_offset_x + src_pt.x, src_offset_y + src_pt.y, -1); + } } } } |