#19197 [NEW]: Serious bug with ImageCreateTrueColor and/or ? file upload

From: bugsphp@yayel.com Operating system: Linux Redhat 7.2 PHP version: 4.2.2 PHP Bug Type: GD related Bug description: Serious bug with ImageCreateTrueColor and/or ? file upload Hi Having a script in charge of resampling uploaded pictures. This following bug only affects Gif image with ImageCreateTrueColor() function. Note that things go ok with ImageCreate() function, and with jpeg/png files and ImageCreateTrueColor() function. The script takes and checks a fresh uploaded picture, merges it with my logo, resizes it with ImageCopyResampled and saves both original and thumbnails with the apropriate function (ImageGif, ImageJpg, ImagePng), insert properties in mysql db and cleans e/t at the end. I did use ImageCreate() for creating my thumbnails, and colors were bad until I used ImageCreateTrueColor() BUT if I uploaded an image with $_FILES["file"]["type"] == 'image/gif', things go weird as the script tries 20 times to saves the files and insert into mysql (and there is no loop coded at all!!!) According to Apache log, my http client calls only one time the script. This is really bizarre and I do worry about it, since it may be a security problem... Using gd2.0.1 from http://www.rime.com.au/gd/, php4.2.2 with Apache 1.3.26 : './configure' '--with-apache=../apache_1.3.26' '--enable-trans-sid' '--with-jpeg-dir' '--with-gd=../gd-2.0.1' '--with-tiff-dir' '--with-png-dir' '--with-zlib-dir' '--with-pdflib' '--enable-ftp' '--enable-gd-native-ttf' '--with-freetype-dir=/usr/include/freetype2' '--with-mysql=/usr/local/mysql' '--with-gettext' '--with-pgsql=/usr' '--with-imap' '--with-kerberos' '--enable-sysvsem' '--enable-sysvshm' '--with-xml' '--with-db' '--enable-bcmath' '--enable-calendar' '--with-imap-ssl' Tell me if you want more details or code exemples. Thank you. -- Edit bug report at http://bugs.php.net/?id=19197&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=19197&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=19197&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=19197&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=19197&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=19197&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=19197&r=support Expected behavior: http://bugs.php.net/fix.php?id=19197&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=19197&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=19197&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=19197&r=globals