diff options
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/gd/libgd/gd_gd2.c | 2 | ||||
| -rw-r--r-- | ext/gd/tests/bug73159.phpt | 21 |
3 files changed, 24 insertions, 1 deletions
@@ -32,6 +32,8 @@ PHP NEWS (Mark Plomer, cmb) . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb) . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb) + . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted + files). (cmb) - Mbstring: . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb) diff --git a/ext/gd/libgd/gd_gd2.c b/ext/gd/libgd/gd_gd2.c index 3b4dfbe098..57d5844510 100644 --- a/ext/gd/libgd/gd_gd2.c +++ b/ext/gd/libgd/gd_gd2.c @@ -670,7 +670,7 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt) /* Force fmt to a valid value since we don't return anything. */ if ((fmt != GD2_FMT_RAW) && (fmt != GD2_FMT_COMPRESSED)) { - fmt = im->trueColor ? GD2_FMT_TRUECOLOR_COMPRESSED : GD2_FMT_COMPRESSED; + fmt = GD2_FMT_COMPRESSED; } if (im->trueColor) { fmt += 2; diff --git a/ext/gd/tests/bug73159.phpt b/ext/gd/tests/bug73159.phpt new file mode 100644 index 0000000000..4889ffb6fd --- /dev/null +++ b/ext/gd/tests/bug73159.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #73159 (imagegd2(): unrecognized formats may result in corrupted files) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$im = imagecreatetruecolor(10, 10); + +ob_start(); +imagegd2($im, null, 128, 0); +$buffer = ob_get_clean(); + +$header = unpack('@12/nformat', $buffer); +printf("format: %d\n", $header['format']); +?> +===DONE=== +--EXPECT-- +format: 4 +===DONE=== |