Re: [INTERNALS-WIN] ext/gd: drop XPM support on Windows

Hi Christoph, Thank you for this suggestion. I have one question. The GD PHP extension defines "imagecreatefromxpm" functions. How do you manage it if XPM support is disabled? GD (libxpm) must be updated for the currently supported PHP versions to provide a security fix. I have applied 5 patches on the master branch of winlibs/libxpm on php-win-ext fork [1] and tagged "libxpm-3.5.12-1". The patch for the last CVE has been manually integrated. How do we integrate this fix? Patch on winlibs-builder? PR on winlibs/libxpm repository? [1] <https://github.com/php-win-ext/libxpm/tree/security-fix> Le 11/09/2024 à 14:55, Christoph M. Becker a écrit :

Hi all, I'm in the progress of updating all libraries required for ext/gd on Windows. Since libxpm hasn't been updated for quite a while (we're still shipping libxpm 3.5.12), I've attempted updating to libxpm 3.5.17. However, besides the already existing mess of needing to fetch several X11 header files from other repos, I've noticed that support for FOR_MSW builds has completely been dropped[1]. That makes it even harder to have a somewhat clean build. Looking a bit further, I've noticed that three vulnerabilites have been fixed in libxpm 3.5.15[2]; the third one doesn't affect our builds, but the first two likely do, causing potential DoS, if crafted XPM images are read by imagecreatefromxpm() (but not by imagecreatefromstring() since this doesn't support XPM). While it should be possible to upgrade to libxpm 3.5.15 (or at least to backport the respective fixes), I don't think it makes sense to move forward supporting XPM images with ext/gd on Windows. Besides that this format is typically used on Linux, it is grossly out-dated. Even Gif is way superior, let alone PNG. Therefore I suggest dropping XPM support from ext/gd on Windows as soon as possible (might be a bit late for PHP 8.4, but might still be a good idea). Note that XBM support is unrelated, since this is handled by the bundled libgd without relying on any library. Also note that getimagesize() is also not affected, since it doesn't support XPM anyway. Any objections, or general thoughts? [1] <https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/b30fd0918f8d99aa718ede3da30f9d29f87063e1> [2] <https://lists.x.org/archives/xorg-announce/2023-January/003312.html> Christoph