MFH: Fixed crash inside cpdf_place_inline_image() when working with

truecolor images.

2 files changed, 22 insertions, 6 deletions

diff --git a/NEWS b/NEWS
index 0149f526e7..e4e35b707e 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@ PHP 4                                                                      NEWS
 - Upgraded bundled GD library to 2.0.23. (Ilia)
 - Fixed possible crash inside pg_copy_(to|from) function if delimiter is more
   then 1 character long. (Ilia)
+- Fixed crash inside cpdf_place_inline_image() when working with truecolor
+  images. (Ilia)
 - Fixed handling of return values from storred procedures in mssql_execute()
   with multiple result sets returned. (Frank)
 - Fixed logic bug in session_register() which allowed registering _SESSION
diff --git a/ext/cpdf/cpdf.c b/ext/cpdf/cpdf.c
index 8328c71839..88655ff1d1 100644
--- a/ext/cpdf/cpdf.c
+++ b/ext/cpdf/cpdf.c
@@ -2522,16 +2522,30 @@ PHP_FUNCTION(cpdf_place_inline_image)
 	}
 
 	count = 3 * im->sx * im->sy;
-	if(NULL == (buffer = (unsigned char *) emalloc(count)))
-		RETURN_FALSE;
+	buffer = (unsigned char *) safe_emalloc(3 * im->sx, im->sy, 0);
 
 	ptr = buffer;
 	for(i=0; i<im->sy; i++) {
 		for(j=0; j<im->sx; j++) {
-			color = im->pixels[i][j];
-			*ptr++ = im->red[color];
-			*ptr++ = im->green[color];
-			*ptr++ = im->blue[color];
+#if HAVE_LIBGD20
+			if(gdImageTrueColor(im)) {
+				if (im->tpixels && gdImageBoundsSafe(im, j, i)) {
+					color = gdImageTrueColorPixel(im, j, i);
+					*ptr++ = (color >> 16) & 0xFF;
+					*ptr++ = (color >> 8) & 0xFF;
+					*ptr++ = color & 0xFF;
+				}
+			} else {
+#endif
+				if (im->pixels && gdImageBoundsSafe(im, j, i)) {
+					color = im->pixels[i][j];
+					*ptr++ = im->red[color];
+					*ptr++ = im->green[color];
+					*ptr++ = im->blue[color];
+				}
+#if HAVE_LIBGD20
+			}
+#endif
 		}
 	}