From d4bd6fb491ccaf70006d6f671755126b47a71bcb Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Fri, 22 May 2020 09:11:28 +0200
Subject: Fix #79615: Wrong GIF header written in GD GIFEncode

The color resolution is expected in bits 4-6 of the packed fields byte
of the logical screen descriptor (byte 10 of the GIF data stream),
according to the specification[1], section 18.

[1] <https://www.w3.org/Graphics/GIF/spec-gif89a.txt>
---
 NEWS                       |  3 +++
 ext/gd/libgd/gd_gif_out.c  |  2 +-
 ext/gd/tests/bug79615.phpt | 20 ++++++++++++++++++++
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 ext/gd/tests/bug79615.phpt

diff --git a/NEWS b/NEWS
index dbb6da2c7f..f9ae00e8e4 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,9 @@ PHP                                                                        NEWS
   . Fixed bug #79566 (Private SHM is not private on Windows). (cmb)
   . Fixed bug #79489 (.user.ini does not inherit). (cmb)
 
+- GD:
+  . Fixed bug #79615 (Wrong GIF header written in GD GIFEncode). (sageptr, cmb)
+
 - MySQLnd:
   . Fixed bug #79596 (MySQL FLOAT truncates to int some locales). (cmb)
 
diff --git a/ext/gd/libgd/gd_gif_out.c b/ext/gd/libgd/gd_gif_out.c
index c0a0433f4d..771e8afe2e 100644
--- a/ext/gd/libgd/gd_gif_out.c
+++ b/ext/gd/libgd/gd_gif_out.c
@@ -319,7 +319,7 @@ GIFEncode(gdIOCtxPtr fp, int GWidth, int GHeight, int GInterlace, int Background
         /*
          * OR in the resolution
          */
-        B |= (Resolution - 1) << 5;
+        B |= (Resolution - 1) << 4;
 
         /*
          * OR in the Bits per Pixel
diff --git a/ext/gd/tests/bug79615.phpt b/ext/gd/tests/bug79615.phpt
new file mode 100644
index 0000000000..b7cf9175c5
--- /dev/null
+++ b/ext/gd/tests/bug79615.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #79615 (Wrong GIF header written in GD GIFEncode)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(3, 3); // 3x3, 9 colors, 4 bits per pixel
+for ($x = 0; $x < 3; $x++) {
+    for ($y = 0; $y < 3; $y++) {
+        imagesetpixel($im, $x, $y, imagecolorallocate($im, $x, $y, 0));
+    }
+}
+ob_start();
+imagegif($im);
+echo decbin(ord(ob_get_clean()[0xA]));
+?>
+--EXPECT--
+10110011
-- 
cgit v1.2.1