diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2016-09-24 00:46:35 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2016-09-24 10:33:49 +0200 |
| commit | c7936ead8fbe87a55e7c17f9449c2704acd810a3 (patch) | |
| tree | 463f5655293374f19af48d489cfafbcf773471f8 | |
| parent | 1da79a6c6e39f08a91c2e3ae9281c1b0e5261510 (diff) | |
| download | php-git-c7936ead8fbe87a55e7c17f9449c2704acd810a3.tar.gz | |
Fix #73155: imagegd2() writes wrong chunk sizes on boundaries
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/gd/libgd/gd_gd2.c | 4 | ||||
| -rw-r--r-- | ext/gd/tests/bug73155.phpt | 28 |
3 files changed, 31 insertions, 2 deletions
@@ -27,6 +27,7 @@ PHP NEWS . Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box). (Mark Plomer, cmb) . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb) + . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb) - Mbstring: . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb) diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c index e954aafa68..3b4dfbe098 100644 --- a/ext/gd/libgd/gd_gd2.c +++ b/ext/gd/libgd/gd_gd2.c @@ -689,8 +689,8 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt) } /* Work out number of chunks. */ - ncx = im->sx / cs + 1; - ncy = im->sy / cs + 1; + ncx = (im->sx + cs - 1) / cs; + ncy = (im->sy + cs - 1) / cs; /* Write the standard header. */ _gd2PutHeader (im, out, cs, fmt, ncx, ncy); diff --git a/ext/gd/tests/bug73155.phpt b/ext/gd/tests/bug73155.phpt new file mode 100644 index 0000000000..dc1791e565 --- /dev/null +++ b/ext/gd/tests/bug73155.phpt @@ -0,0 +1,28 @@ +--TEST-- +Bug #73155 (imagegd2() writes wrong chunk sizes on boundaries) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$im = imagecreate(64, 64); +imagecolorallocate($im, 0, 0, 0); + +ob_start(); +imagegd2($im, null, 64, IMG_GD2_RAW); +$buffer = ob_get_clean(); + +$header = unpack('@10/nchunk_size/nformat/nx_count/ny_count', $buffer); +printf("chunk size: %d\n", $header['chunk_size']); +printf("x chunk count: %d\n", $header['x_count']); +printf("y chunk count: %d\n", $header['y_count']); +printf("file size: %d\n", strlen($buffer)); +?> +===DONE=== +--EXPECT-- +chunk size: 64 +x chunk count: 1 +y chunk count: 1 +file size: 5145 +===DONE=== |