From fc989fc6e773ccfb4d9ade0f466a3c5c2820bfdc Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Mon, 10 Oct 2016 11:40:16 +0200
Subject: Fix #73279: Integer overflow in gdImageScaleBilinearPalette()

The color components are supposed to be in range 0..255, so we must not
cast them to `signed char`, what can be the default for `char`.

Port of <https://github.com/libgd/libgd/commit/77c8d359>.
---
 ext/gd/tests/bug73279.phpt     | 20 ++++++++++++++++++++
 ext/gd/tests/bug73279_old.phpt | 22 ++++++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 ext/gd/tests/bug73279.phpt
 create mode 100644 ext/gd/tests/bug73279_old.phpt

(limited to 'ext/gd/tests')

diff --git a/ext/gd/tests/bug73279.phpt b/ext/gd/tests/bug73279.phpt
new file mode 100644
index 0000000000..e6c6709039
--- /dev/null
+++ b/ext/gd/tests/bug73279.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.4', '<')) {
+    die('skip only for bundled libgd or external libgd >= 2.2.4');
+}
+?>
+--FILE--
+<?php
+$src = imagecreate(100, 100);
+imagecolorallocate($src, 255, 255, 255);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+printf("color: %x\n", imagecolorat($dst, 99, 99));
+?>
+===DONE===
+--EXPECT--
+color: ffffff
+===DONE===
diff --git a/ext/gd/tests/bug73279_old.phpt b/ext/gd/tests/bug73279_old.phpt
new file mode 100644
index 0000000000..0cbbec34f2
--- /dev/null
+++ b/ext/gd/tests/bug73279_old.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (GD_BUNDLED || version_compare(GD_VERSION, '2.2.4', '>=')) {
+    die('skip only for external libgd < 2.2.4');
+}
+?>
+--FILE--
+<?php
+$src = imagecreate(100, 100);
+imagecolorallocate($src, 255, 255, 255);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+printf("color: %x\n", imagecolorat($dst, 99, 99));
+?>
+===DONE===
+--XFAIL--
+Bug #330 has not yet been fixed
+--EXPECT--
+color: ffffff
+===DONE===
-- 
cgit v1.2.1