4 files changed, 112 insertions, 1 deletions
diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 30acee57e6..5fe9ecdfcc 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1429,6 +1429,11 @@ PHP_FUNCTION(imagecreatefromstring)
 	}
 
 	convert_to_string_ex(data);
+	if (Z_STRLEN_PP(data) < 8) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty string or invalid image");
+		RETURN_FALSE;
+	}
+
 	memcpy(sig, Z_STRVAL_PP(data), 8);
 
 	imtype = _php_image_type(sig);
@@ -1480,7 +1485,7 @@ PHP_FUNCTION(imagecreatefromstring)
 			break;
 
 		default:
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Data is not in a recognized format.");
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Data is not in a recognized format");
 			RETURN_FALSE;
 	}
 
diff --git a/ext/gd/tests/copypalette.phpt b/ext/gd/tests/copypalette.phpt
new file mode 100644
index 0000000000..2962455b65
--- /dev/null
+++ b/ext/gd/tests/copypalette.phpt
@@ -0,0 +1,43 @@
+--TEST--
+imagepalettecopy
+--SKIPIF--
+<?php
+        if (!function_exists('imagecolorat')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$im = imagecreate(1,1);
+for ($i=0; $i<256; $i++) {
+	imagecolorallocate($im, $i, $i, $i);
+}
+
+$im2 = imagecreate(1,1);
+imagepalettecopy($im2, $im);
+
+for ($i=0; $i<256; $i++) {
+	$c = imagecolorsforindex($im2, $i);
+	if ($c['red']!=$i || $c['green']!=$i || $c['blue']!=$i) {
+		$failed = true;
+		break;
+	} 
+}
+echo "copy palette 255 colors: ";
+echo $failed ? 'failed' : 'ok';
+echo "\n";
+
+$im = imagecreate(1,1);
+$im2 = imagecreate(1,1);
+imagecolorallocatealpha($im, 0,0,0,100);
+
+imagepalettecopy($im2, $im);
+$c = imagecolorsforindex($im2, 0);
+if ($c['red']!=0 || $c['green']!=0 || $c['blue']!=0 || $c['alpha']!=100) {
+	$failed = true;
+} 
+echo 'copy palette 1 color and alpha: ';
+echo $failed ? 'failed' : 'ok';
+echo "\n";
+?>
+--EXPECT--
+copy palette 255 colors: ok
+copy palette 1 color and alpha: ok
diff --git a/ext/gd/tests/createfromstring.phpt b/ext/gd/tests/createfromstring.phpt
new file mode 100644
index 0000000000..b3d7dde157
--- /dev/null
+++ b/ext/gd/tests/createfromstring.phpt
@@ -0,0 +1,63 @@
+--TEST--
+imagecreatefromstring
+--SKIPIF--
+<?php
+        if (!function_exists('imagecreatefromstring')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$dir = dirname(__FILE__);
+
+$im = imagecreatetruecolor(5,5);
+imagefill($im, 0,0, 0xffffff);
+imagesetpixel($im, 3,3, 0x0);
+imagepng($im, $dir . '/tc.png');
+
+$im_string = file_get_contents(dirname(__FILE__) . '/tc.png');
+$im = imagecreatefromstring($im_string);
+echo 'createfromstring truecolor png: ';
+if (imagecolorat($im, 3,3) != 0x0) {
+	echo 'failed';
+} else {
+	echo 'ok';
+}
+echo "\n";
+unlink($dir . '/tc.png');
+
+
+
+$im = imagecreate(5,5);
+$c1 = imagecolorallocate($im, 255,255,255);
+$c2 = imagecolorallocate($im, 255,0,0);
+imagefill($im, 0,0, $c1);
+imagesetpixel($im, 3,3, $c2);
+imagepng($im, $dir . '/p.png');
+
+$im_string = file_get_contents(dirname(__FILE__) . '/p.png');
+$im = imagecreatefromstring($im_string);
+
+echo'createfromstring palette png: ';
+
+$c = imagecolorsforindex($im, imagecolorat($im, 3,3));
+$failed = false;
+if ($c['red'] != 255 || $c['green'] != 0 || $c['blue'] != 0) {
+	echo 'failed';
+} else {
+	echo 'ok';
+}
+echo "\n";
+unlink($dir . '/p.png');
+
+
+//empty string
+$im = imagecreatefromstring('');
+//random string > 8
+$im = imagecreatefromstring(' asdf jklp');
+?>
+--EXPECTF--
+createfromstring truecolor png: ok
+createfromstring palette png: ok
+
+Warning: imagecreatefromstring(): Empty string or invalid image in %screatefromstring.php on line %d
+
+Warning: imagecreatefromstring(): Data is not in a recognized format in %screatefromstring.php on line %d
diff --git a/ext/gd/tests/src.png b/ext/gd/tests/src.png
new file mode 100644
index 0000000000..d38c74268a
--- /dev/null
+++ b/ext/gd/tests/src.png