com php-src: Fix #73968: Premature failing of XBM reading: NEWS ext/gd/libgd/xbm.c ext/gd/tests/bug73968.phpt ext/gd/tests/bug73968.xbm
ext/gd/tests/libgd00094.phpt

Commit: f67d599a0179d0895170c77188847ae60b497714 Author: Christoph M. Becker <cmbecker69@gmx.de> Sat, 21 Jan 2017 01:21:03 +0100 Parents: 8da87563122e4d14208b2827fd6b2807578677ec Branches: PHP-7.0 PHP-7..1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=f67d599a0179d0895170c77188847ae60b497714 Log: Fix #73968: Premature failing of XBM reading We must take into account the line padding, when we're reading XBM files. We deliberately ignore the potential integer overflow here, because that would be caught by gdImageCreate() or even earlier if bytes==0, what happens in libgd00094.phpt which we adapt accordingly. Bugs: https://bugs.php.net/73968 Changed paths: M NEWS M ext/gd/libgd/xbm.c A ext/gd/tests/bug73968.phpt A ext/gd/tests/bug73968.xbm M ext/gd/tests/libgd00094.phpt Diff: diff --git a/NEWS b/NEWS index 2c403eb..d96e7be 100644 --- a/NEWS +++ b/NEWS @@ -15,6 +15,9 @@ PHP NEWS . Fixed bug #67583 (double fastcgi_end_request on max_children limit). (Dmitry Saprykin) +- GD: + . Fixed bug #73968 (Premature failing of XBM reading). (cmb) + - GMP: . Fixed bug #69993 (test for gmp.h needs to test machine includes). (Jordan Gigov) diff --git a/ext/gd/libgd/xbm.c b/ext/gd/libgd/xbm.c index 88d27a9..044159d 100644 --- a/ext/gd/libgd/xbm.c +++ b/ext/gd/libgd/xbm.c @@ -77,7 +77,7 @@ gdImagePtr gdImageCreateFromXbm(FILE * fd) max_bit = 32768; } if (max_bit) { - bytes = (width * height / 8) + 1; + bytes = (width + 7) / 8 * height; if (!bytes) { return 0; } diff --git a/ext/gd/tests/bug73968.phpt b/ext/gd/tests/bug73968.phpt new file mode 100644 index 0000000..fd17fe2 --- /dev/null +++ b/ext/gd/tests/bug73968.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #73968 (Premature failing of XBM reading) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$im = imagecreatefromxbm(__DIR__ . DIRECTORY_SEPARATOR . 'bug73968.xbm'); +var_dump($im); +?> +===DONE=== +--EXPECTF-- +resource(%d) of type (gd) +===DONE=== diff --git a/ext/gd/tests/bug73968.xbm b/ext/gd/tests/bug73968.xbm new file mode 100644 index 0000000..f427d86 --- /dev/null +++ b/ext/gd/tests/bug73968.xbm @@ -0,0 +1,5 @@ +#define test_width 10 +#define test_height 10 +static unsigned char test_bits[] = { + 0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00, + 0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00}; diff --git a/ext/gd/tests/libgd00094.phpt b/ext/gd/tests/libgd00094.phpt index d1d68ea..d06afc4 100644 --- a/ext/gd/tests/libgd00094.phpt +++ b/ext/gd/tests/libgd00094.phpt @@ -11,9 +11,6 @@ $im = imagecreatefromxbm(dirname(__FILE__) . '/libgd00094.xbm'); var_dump($im); ?> --EXPECTF-- -Warning: imagecreatefromxbm(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully - in %slibgd00094.php on line %d - Warning: imagecreatefromxbm(): '%slibgd00094.xbm' is not a valid XBM file in %slibgd00094.php on line %d bool(false)