Merge branch 'master' of git.php.net:/php-src

* 'master' of git.php.net:/php-src:
  Update NEWS
  Fixed bug #75571: Potential infinite loop in gdImageCreateFromGifCtx
  Fix bug #74782: remove file name from output to avoid XSS

3 files changed, 20 insertions, 5 deletions

diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index 262350ef44..8b2a1b42fa 100644
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -262,10 +262,6 @@ terminated:
 	if (!im) {
 		return 0;
 	}
-	if (!im->colorsTotal) {
-		gdImageDestroy(im);
-		return 0;
-	}
 	/* Check for open colors at the end, so
 	   we can reduce colorsTotal and ultimately
 	   BitsPerPixel */
@@ -276,6 +272,10 @@ terminated:
 			break;
 		}
 	}
+	if (!im->colorsTotal) {
+		gdImageDestroy(im);
+		return 0;
+	}
 	return im;
 }
 /* }}} */
@@ -376,7 +376,7 @@ static int
 GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
 {
 	int           i, j, ret;
-	unsigned char count;
+	int           count;
 
 	if (flag) {
 		scd->curbit = 0;
diff --git a/ext/gd/tests/bug75571.gif b/ext/gd/tests/bug75571.gif
new file mode 100644
index 0000000000..3c30b40f28
--- /dev/null
+++ b/ext/gd/tests/bug75571.gif
diff --git a/ext/gd/tests/bug75571.phpt b/ext/gd/tests/bug75571.phpt
new file mode 100644
index 0000000000..5bd26b84ec
--- /dev/null
+++ b/ext/gd/tests/bug75571.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #75571 (Infinite loop in GIF reading causing DoS)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgif(): '%s' is not a valid GIF file in %s on line %d
+bool(false)
+===DONE===