Merge branch 'openssl_error_store' into openssl_aead

5 files changed, 109 insertions, 13 deletions

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index b427831672..5c7b5ce1ba 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1049,11 +1049,13 @@ void gdImageAABlend (gdImagePtr im)
 	}
 }
 
+static void _gdImageFilledHRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color);
+
 static void gdImageHLine(gdImagePtr im, int y, int x1, int x2, int col)
 {
 	if (im->thick > 1) {
 		int thickhalf = im->thick >> 1;
-		gdImageFilledRectangle(im, x1, y - thickhalf, x2, y + im->thick - thickhalf - 1, col);
+		_gdImageFilledHRectangle(im, x1, y - thickhalf, x2, y + im->thick - thickhalf - 1, col);
 	} else {
 		if (x2 < x1) {
 			int t = x2;
@@ -1767,6 +1769,12 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 		return;
 	}
 
+	if (!im->trueColor) {
+		if ((color > (im->colorsTotal - 1)) || (border > (im->colorsTotal - 1)) || (color < 0)) {
+			return;
+		}
+	}
+
 	restoreAlphaBlending = im->alphaBlendingFlag;
 	im->alphaBlendingFlag = 0;
 
@@ -2112,10 +2120,53 @@ void gdImageRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 	}
 }
 
-void gdImageFilledRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
+static void _gdImageFilledHRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 {
 	int x, y;
 
+	if (x1 == x2 && y1 == y2) {
+		gdImageSetPixel(im, x1, y1, color);
+		return;
+	}
+
+	if (x1 > x2) {
+		x = x1;
+		x1 = x2;
+		x2 = x;
+	}
+
+	if (y1 > y2) {
+		y = y1;
+		y1 = y2;
+		y2 = y;
+	}
+
+	if (x1 < 0) {
+		x1 = 0;
+	}
+
+	if (x2 >= gdImageSX(im)) {
+		x2 = gdImageSX(im) - 1;
+	}
+
+	if (y1 < 0) {
+		y1 = 0;
+	}
+
+	if (y2 >= gdImageSY(im)) {
+		y2 = gdImageSY(im) - 1;
+	}
+
+	for (x = x1; (x <= x2); x++) {
+		for (y = y1; (y <= y2); y++) {
+			gdImageSetPixel (im, x, y, color);
+		}
+	}
+}
+
+static void _gdImageFilledVRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
+{
+	int x, y;
 
 	if (x1 == x2 && y1 == y2) {
 		gdImageSetPixel(im, x1, y1, color);
@@ -2157,6 +2208,11 @@ void gdImageFilledRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int
 	}
 }
 
+void gdImageFilledRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
+{
+	_gdImageFilledVRectangle(im, x1, y1, x2, y2, color);
+}
+
 void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX, int srcY, int w, int h)
 {
 	int c;
diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c
index efc6ef47af..6726fee826 100644
--- a/ext/gd/libgd/gd_gd2.c
+++ b/ext/gd/libgd/gd_gd2.c
@@ -145,9 +145,15 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in
 		cidx = gdCalloc(sidx, 1);
 		for (i = 0; i < nc; i++) {
 			if (gdGetInt(&cidx[i].offset, in) != 1) {
+				gdFree(cidx);
 				goto fail1;
 			}
 			if (gdGetInt(&cidx[i].size, in) != 1) {
+				gdFree(cidx);
+				goto fail1;
+			}
+			if (cidx[i].offset < 0 || cidx[i].size < 0) {
+				gdFree(cidx);
 				goto fail1;
 			}
 		}
diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c
index a06e333add..6d703b8b30 100644
--- a/ext/gd/libgd/gd_interpolation.c
+++ b/ext/gd/libgd/gd_interpolation.c
@@ -932,9 +932,6 @@ static inline LineContribType *_gdContributionsCalc(unsigned int line_size, unsi
         double dTotalWeight = 0.0;
 		int iSrc;
 
-        res->ContribRow[u].Left = iLeft;
-        res->ContribRow[u].Right = iRight;
-
         /* Cut edge points to fit in filter window in case of spill-off */
         if (iRight - iLeft + 1 > windows_size)  {
             if (iLeft < ((int)src_size - 1 / 2))  {
@@ -944,6 +941,9 @@ static inline LineContribType *_gdContributionsCalc(unsigned int line_size, unsi
             }
         }
 
+        res->ContribRow[u].Left = iLeft;
+        res->ContribRow[u].Right = iRight;
+
         for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
             dTotalWeight += (res->ContribRow[u].Weights[iSrc-iLeft] =  scale_f_d * (*pFilter)(scale_f_d * (dCenter - (double)iSrc)));
         }
@@ -1059,6 +1059,10 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 	gdImagePtr tmp_im;
 	gdImagePtr dst;
 
+	if (new_width == 0 || new_height == 0) {
+		return NULL;
+	}
+
 	/* Convert to truecolor if it isn't; this code requires it. */
 	if (!src->trueColor) {
 		gdImagePaletteToTrueColor(src);
@@ -1087,6 +1091,10 @@ gdImagePtr Scale(const gdImagePtr src, const unsigned int src_width, const unsig
 {
 	gdImagePtr tmp_im;
 
+	if (new_width == 0 || new_height == 0) {
+		return NULL;
+	}
+
 	tmp_im = gdImageCreateTrueColor(new_width, src_height);
 	if (tmp_im == NULL) {
 		return NULL;
@@ -1096,7 +1104,7 @@ gdImagePtr Scale(const gdImagePtr src, const unsigned int src_width, const unsig
 	_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
 	_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
 
-	gdFree(tmp_im);
+	gdImageDestroy(tmp_im);
 	return dst;
 }
 
@@ -1120,6 +1128,10 @@ gdImagePtr gdImageScaleNearestNeighbour(gdImagePtr im, const unsigned int width,
 	unsigned long  dst_offset_y = 0;
 	unsigned int i;
 
+	if (new_width == 0 || new_height == 0) {
+		return NULL;
+	}
+
 	dst_img = gdImageCreateTrueColor(new_width, new_height);
 
 	if (dst_img == NULL) {
@@ -1221,6 +1233,10 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 	gdImagePtr new_img;
 	const int transparent = im->transparent;
 
+	if (new_width == 0 || new_height == 0) {
+		return NULL;
+	}
+
 	new_img = gdImageCreateTrueColor(new_width, new_height);
 	if (new_img == NULL) {
 		return NULL;
@@ -1313,6 +1329,10 @@ static gdImagePtr gdImageScaleBilinearTC(gdImagePtr im, const unsigned int new_w
 	long i;
 	gdImagePtr new_img;
 
+	if (new_width == 0 || new_height == 0) {
+		return NULL;
+	}
+
 	new_img = gdImageCreateTrueColor(new_width, new_height);
 	if (!new_img){
 		return NULL;
@@ -1412,6 +1432,10 @@ gdImagePtr gdImageScaleBicubicFixed(gdImagePtr src, const unsigned int width, co
 	unsigned int dst_offset_y = 0;
 	long i;
 
+	if (new_width == 0 || new_height == 0) {
+		return NULL;
+	}
+
 	/* impact perf a bit, but not that much. Implementation for palette
 	   images can be done at a later point.
 	*/
@@ -1634,7 +1658,11 @@ gdImagePtr gdImageScale(const gdImagePtr src, const unsigned int new_width, cons
 	gdImagePtr im_scaled = NULL;
 
 	if (src == NULL || src->interpolation_id < 0 || src->interpolation_id > GD_METHOD_COUNT) {
-		return 0;
+		return NULL;
+	}
+
+	if (new_width == 0 || new_height == 0) {
+		return NULL;
 	}
 
 	switch (src->interpolation_id) {
@@ -1680,6 +1708,10 @@ gdImagePtr gdImageRotateNearestNeighbour(gdImagePtr src, const float degrees, co
 	unsigned int i;
 	gdImagePtr dst;
 
+	if (new_width == 0 || new_height == 0) {
+		return NULL;
+	}
+
 	dst = gdImageCreateTrueColor(new_width, new_height);
 	if (!dst) {
 		return NULL;
diff --git a/ext/gd/libgd/gd_webp.c b/ext/gd/libgd/gd_webp.c
index eef65f79fb..da0cc9d5b8 100644
--- a/ext/gd/libgd/gd_webp.c
+++ b/ext/gd/libgd/gd_webp.c
@@ -14,6 +14,8 @@ gdImagePtr gdImageCreateFromWebp (FILE * inFile)
 {
 	gdImagePtr im;
 	gdIOCtx *in = gdNewFileCtx(inFile);
+	if (!in)
+		return 0;
 	im = gdImageCreateFromWebpCtx(in);
 	in->gd_free(in);
 
@@ -37,13 +39,14 @@ gdImagePtr gdImageCreateFromWebpCtx (gdIOCtx * infile)
 	int    width, height;
 	uint8_t   *filedata = NULL;
 	uint8_t    *argb = NULL;
-	unsigned char   *read, *temp;
 	size_t size = 0, n;
 	gdImagePtr im;
 	int x, y;
 	uint8_t *p;
 
 	do {
+		unsigned char *read, *temp;
+
 		temp = gdRealloc(filedata, size+GD_WEBP_ALLOC_STEP);
 		if (temp) {
 			filedata = temp;
@@ -64,19 +67,19 @@ gdImagePtr gdImageCreateFromWebpCtx (gdIOCtx * infile)
 
 	if (WebPGetInfo(filedata,size, &width, &height) == 0) {
 		zend_error(E_ERROR, "gd-webp cannot get webp info");
-		gdFree(temp);
+		gdFree(filedata);
 		return NULL;
 	}
 
 	im = gdImageCreateTrueColor(width, height);
 	if (!im) {
-		gdFree(temp);
+		gdFree(filedata);
 		return NULL;
 	}
 	argb = WebPDecodeARGB(filedata, size, &width, &height);
 	if (!argb) {
 		zend_error(E_ERROR, "gd-webp cannot allocate temporary buffer");
-		gdFree(temp);
+		gdFree(filedata);
 		gdImageDestroy(im);
 		return NULL;
 	}
@@ -92,7 +95,6 @@ gdImagePtr gdImageCreateFromWebpCtx (gdIOCtx * infile)
 	gdFree(filedata);
 	/* do not use gdFree here, in case gdFree/alloc is mapped to something else than libc */
 	free(argb);
-	gdFree(temp);
 	im->saveAlphaFlag = 1;
 	return im;
 }
diff --git a/ext/gd/libgd/xbm.c b/ext/gd/libgd/xbm.c
index d127a1d4ff..b351814abb 100644
--- a/ext/gd/libgd/xbm.c
+++ b/ext/gd/libgd/xbm.c
@@ -210,7 +210,7 @@ void gdImageXbmCtx(gdImagePtr image, char* file_name, int fg, gdIOCtx * out)
 			if (gdImageGetPixel(image, x, y) == fg) {
 				c |= b;
 			}
-			if ((b == 128) || (x == sx && y == sy)) {
+			if ((b == 128) || (x == sx - 1)) {
 				b = 1;
 				if (p) {
 					gdCtxPrintf(out, ", ");