Commit Graph

485 Commits

Author SHA1 Message Date
Stanislav Malyshev
b15f0ecc0f Fix for bug #71912 (libgd: signedness vulnerability) 2016-04-18 22:24:16 -07:00
Mark Plomer
f5f94d9c08 fix left-shifted/misaligned bounding-box + wrong kerning in imagettfbbox/imageftbbox
- load glyph with FT_LOAD_IGNORE_TRANSFORM for bbox as final bbox is rotated at once later (fixes "double-rotation" per glyph for calculating bbox)
- reload the rotated glyph for painting after that (only if angle != 0)
- rotate the original bbox at 0,0 and do not throw away xMin/yMin (drawing-rotation is also based at "origin" point - including the bearingX, see http://www.freetype.org/freetype2/docs/glyphs/glyphs-3.html#section-3) - this fixes the "left-shift"-problem also when angle = 0
- removed "xb/yb" and use "x/y" directly for offsetting brect (no need for adding "x1/y1" and substracting "yd" later)
- removed therefore unused "yd" helper var which seems tried to fix parts of the original problems
- initialize x/y with 0 instead of -1 in php_imagettftext_common() to make image*text() and image*bbox() results identical (there was a -1px shift in image*bbox() before)
- fixed gdroundupdown() for negative numbers (-256 / 64 gives -5 instead of -4 before)
- rotate kerning-delta by given angle (fixes completely wrong kerning and therefore wrong bounding box if angle != 0)
- changed 3 tests and added a new one to test for the new (better) coordinates
2016-04-03 12:11:26 +02:00
Paul Tarjan
9f25f736ed Dont ignore errors from FT_Get_Glyph 2016-04-03 12:11:25 +02:00
Remi Collet
aa8d3a8cc6 fix the fix for bug #70976 (imagerotate) 2016-01-12 14:03:35 +01:00
Remi Collet
14e4d393cf fix the fix for bug #70976 (imagerotate) 2016-01-12 13:52:27 +01:00
Stanislav Malyshev
13750cb0a1 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Update NEWS
  Improve fix for bug #70976
  Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization)
  Fixed bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
  Fixed #70728
  Fixed bug #70755: fpm_log.c memory leak and buffer overflow
  Fix bug #70976: fix boundary check on gdImageRotateInterpolated
  typofix
2016-01-05 19:38:29 -08:00
Lior Kaplan
49493a2dcf Happy new year (Update copyright to 2016) 2016-01-01 19:21:47 +02:00
Stanislav Malyshev
2baeb167a0 Improve fix for bug #70976 2015-12-28 23:44:14 -08:00
Stanislav Malyshev
4bb422343f Fix bug #70976: fix boundary check on gdImageRotateInterpolated 2015-12-07 23:33:05 -08:00
Christoph M. Becker
f1228ebc61 Merge branch 'pull-request/1425' into PHP-5.6
* pull-request/1425:
  revised bug53156.phpt
  Fix #53156: imagerectangle problem with point ordering
2015-07-21 01:13:04 +02:00
Christoph M. Becker
e7f2356665 Fix #66387: Stack overflow with imagefilltoborder
The stack overflow is caused by the recursive algorithm in combination with a
very large negative coordinate passed to gdImageFillToBorder(). As there is
already a clipping for large positive coordinates to the width and height of
the image, it seems to be consequent to clip to zero also.
2015-07-20 23:36:32 +02:00
Christoph M. Becker
72b73e24a0 Fix #53156: imagerectangle problem with point ordering
Contrary to imagefilledrectangle(), imagerectangle() has the documented
limitation that the given points have to be the upper left and the lower right
corner, respectively. However, libgd already caters to upper right / lower left
pairs, and not catering to the other two combinations seems to be an oversight.
2015-07-20 02:14:29 +02:00
Christoph M. Becker
a31fe58d80 Fix #70102: imagecreatefromwebm() shifts colors
libgd internally uses ARGB format, so we have to decode to ARGB instead of
RGBA.
2015-07-19 22:33:54 +02:00
Christoph M. Becker
d3958b32ca fixed Fix #66590, which may segfault 2015-07-19 21:54:55 +02:00
Christoph M. Becker
96e42403d5 Fix #66590: imagewebp() doesn't pad to even length
The code in the bundled libgd uses libvpx and writes the riff manually. The
code generates the correct even size, but neglects the padding. It's possible
older versions of libwebp would decode this, but libwebp 0.4.0 does not.

Let's apply the patch supplied by one of the WebP developers.
2015-07-19 17:38:04 +02:00
Christoph M. Becker
2e34febb73 Fix #66882: imagerotate by -90 degrees truncates image by 1px
Contrary to the external libgd, the bundled libgd doesn't use optimized
rotation algorithms for negative square angles. We fix that now.

There are other improvements in gdImageRotateInterpolated() in the external
libgd. I'll leave them out for now, in the hope that we'll be able to rejoin
the two libraries rather soon.
2015-07-13 22:18:56 +02:00
Christoph M. Becker
1a4722a89e Fix #70064: imagescale(..., IMG_BICUBIC) leaks memory
A temporary image (tmp_im) is created with gdImageTrueColor() and freed with
gdFree() instead of gdImageDestroy(). Let's fix that.
2015-07-13 18:30:33 +02:00
Christoph M. Becker
fa53d8463f Fix #69024: imagescale segfault with palette based image
imagescale(..., IMG_BICUBIC) is not supposed to work with palette images, so we
fix that by converting to true color if necessary. Basically the same fix has
already been applied to the external libgd[1].

[1] <723ea520be>
2015-07-13 15:48:48 +02:00
Christoph M. Becker
094decc3c0 Fix #53154: Zero-height rectangle has whiskers
To avoid drawing the corner pixels twice, gdImageRectangle() draws the vertical
lines 2 points shorter than the actual side of the rectangle. However, this
causes "whiskers" for rectangles with height 0. This patch fixes this issue and
at the same time optimizes the algorithm by drawing only a single line for zero
height and zero width rectangles.
2015-07-13 01:33:00 +02:00
Christoph M. Becker
891ff131ef Fix #67447: imagecrop() adds a black line when cropping
A simple one-off error: imagecrop)() copied only width-1 and height-1 pixels.
2015-07-12 23:05:53 +02:00
Christoph M. Becker
ba7c3a1bb4 Fix #68714: copy 'n paste error
Actually, this is not really a bug fix, but rather a simplification and
optimization in the same vein as has been done with the external libgd, but
going a small step further and joining both for loops.
2015-07-12 16:32:38 +02:00
Remi Collet
565de1ae64 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  NEWS
  Fixed Bug #69479 GD fails to build with newer libvpx
2015-05-24 09:39:20 +02:00
Remi Collet
e807e07bfa Fixed Bug #69479 GD fails to build with newer libvpx
From upstream d41eb72cd4

Fix build with latest libvpx 1.4.0

These new constants exist at least since 1.0.0
Compatibility ones have been droped in 1.4.0
2015-05-24 09:37:12 +02:00
lesniewskister
c12e031530 Reduce downstream patches
As per http://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/lang/php/5.6/patches/patch-ext_gd_libgd_gdcache_h?rev=1.1&content-type=text/x-cvsweb-markup
2015-03-22 21:33:45 -07:00
Xinchen Hui
0579e8278d bump year 2015-01-15 23:26:37 +08:00
Xinchen Hui
73c1be2653 Bump year 2015-01-15 23:26:03 +08:00
Stanislav Malyshev
95183cc339 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix memory leak
2015-01-04 21:08:16 -08:00
Stanislav Malyshev
184b6d9e73 fix memory leak 2015-01-04 21:07:57 -08:00
Remi Collet
f382fbf4c1 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Better fix for #68601 for perf 81e9a993f2
2014-12-17 11:00:52 +01:00
Remi Collet
5fc2fede9c Better fix for #68601 for perf
81e9a993f2
2014-12-17 10:59:36 +01:00
Remi Collet
8bd67ce748 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  NEWS
  Fix bug #68601 buffer read overflow in gd_gif_in.c
2014-12-13 09:05:33 +01:00
Remi Collet
07b5896a13 Fix bug #68601 buffer read overflow in gd_gif_in.c 2014-12-13 09:03:44 +01:00
Veres Lajos
4dc994571d typo fixes - https://github.com/vlajos/misspell_fixer
Conflicts:
	ext/ftp/ftp.h
	ext/pcre/pcrelib/pcre_printint.c
	ext/pcre/pcrelib/sljit/sljitLir.c
	ext/pcre/pcrelib/sljit/sljitLir.h
	ext/pcre/pcrelib/sljit/sljitNativeARM_32.c
	ext/pcre/pcrelib/sljit/sljitNativeTILEGX_64.c
	ext/pgsql/pgsql.c
	ext/phar/func_interceptors.c
	ext/soap/soap.c
	ext/standard/image.c
2014-11-23 14:33:43 -08:00
Sara Golemon
a309dda777 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Switch use of strtok() to gd_strtok_r()
2014-08-19 13:22:14 -07:00
Sara Golemon
ac4569621d Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  Switch use of strtok() to gd_strtok_r()

Conflicts:
	NEWS
2014-08-19 13:17:56 -07:00
Sara Golemon
cbe1597b74 Switch use of strtok() to gd_strtok_r()
strtok() is not thread safe, so this will potentially break in
very bad ways if used in ZTS mode.

I'm not sure why gd_strtok_r() exists since it seems to do the
same thing as strtok_r(), but I'll assume it's a portability
decision and do as the Romans do.
2014-08-19 13:16:44 -07:00
Andrey Hristov
3dc9bef819 Merge branch 'PHP-5.5' into PHP-5.6
Conflicts:
	ext/fileinfo/data_file.c
	ext/fileinfo/libmagic/softmagic.c
	ext/fileinfo/magicdata.patch
2014-08-06 16:25:12 +03:00
Andrey Hristov
41e1ccefd5 Merge branch 'PHP-5.4' into PHP-5.5
Conflicts:
	NEWS
	configure.in
	main/php_version.h
2014-08-06 15:27:56 +03:00
Remi Collet
cf4753691d Fixed Bug #66901 php-gd 'c_color' NULL pointer dereference
Upstream 463c3bd09b

Notice: this fix don't manage monochrome/monovisual values
but just fix the security issue CVE-2014-2497
failing when trying to load such an image
2014-08-04 10:42:39 +02:00
Anatol Belski
0bf5bce6ad Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  made libgd recognize the 9 version series
2014-03-12 19:31:07 +01:00
Anatol Belski
3f049bcff2 made libgd recognize the 9 version series 2014-03-12 19:30:27 +01:00
Remi Collet
44c0581e0c Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  NEWS
  Fix bug  #66887 imagescale - poor quality of scaled image
2014-03-12 17:13:31 +01:00
Remi Collet
862c006da1 Fix bug #66887 imagescale - poor quality of scaled image
Issue with signed char overflow.

Upstream fix:
4b86e06937
2014-03-12 17:10:51 +01:00
Remi Collet
5bd13c5231 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Fixed Bug #66893i imagescale ignore method argument
2014-03-12 15:36:08 +01:00
Remi Collet
f2d5b2b6c6 Fixed Bug #66893i imagescale ignore method argument
We also have our goto fail; bug.

Upstream fix for libgd
5b42b1178c
2014-03-12 15:35:42 +01:00
Remi Collet
cf89ff3d24 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  NEWS
  Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327
2014-03-05 10:44:04 +01:00
Remi Collet
af09d8b96a Fixed Bug #66815 imagecrop(): insufficient fix for NULL defer CVE-2013-7327
This amends commit 8f4a537, which aimed to correct NULL dereference because of
missing check of gdImageCreateTrueColor() / gdImageCreate() return value.  That
commit checks for negative crop rectangle width and height, but
gdImageCreate*() can also return NULL when width * height overflows.  Hence
NULL deref is still possible, as gdImageSaveAlpha() and gdImagePaletteCopy()
is called before dst == NULL check.

This moves NULL check to happen right after gdImageCreate*().  It also removes
width and height check before gdImageCreate*(), as the same check is done by
image create functions (with an extra warning).

From thoger redhat com
2014-03-05 10:40:36 +01:00
Scott MacVicar
796bfb0bd0 imagettftext() uses the last charactermap it found and not the one you want
Summary:
This caused issues when you picked a font with multiple maps, it wouldn't
pick the unicode version but instead pick the last one it saw. Change so
we cache on a per encoding level. There was even a todo list item in the code.

In an ideal world we can probably iterate through at font write time.

Test Plan:
See said unit test, it's Apache Licensed font included
2014-02-16 22:49:31 -08:00
Xinchen Hui
c081ce628f Bump year 2014-01-03 11:08:10 +08:00
Xinchen Hui
47c9027772 Bump year 2014-01-03 11:06:16 +08:00
Xinchen Hui
c0d060f5c0 Bump year 2014-01-03 11:04:26 +08:00
Remi Collet
809eb77689 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  minor fix on previous
2013-12-28 14:29:27 +01:00
Remi Collet
464c219ed4 minor fix on previous 2013-12-28 14:29:14 +01:00
Remi Collet
46809869a3 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Fixed bug #66356 (Heap Overflow Vulnerability in imagecrop())
2013-12-28 14:26:06 +01:00
Remi Collet
8f4a5373bb Fixed bug #66356 (Heap Overflow Vulnerability in imagecrop())
Initial fix was PHP stuff
This one is libgd fix.

- filter invalid crop size
- dont try to copy on invalid position
- fix crop size when out of src image
- fix possible NULL deref
- fix possible integer overfloow
2013-12-28 14:22:13 +01:00
unknown
d32194172a Merge branch 'PHP-5.5'
* PHP-5.5:
  ensure that the defined interpolation method is used by the generic scaling functions
2013-09-09 11:56:58 +02:00
unknown
b54b6e30a4 ensure that the defined interpolation method is used by the generic scaling functions 2013-09-09 11:56:05 +02:00
Christopher Jones
4824d0f43e Merge branch 'PHP-5.5'
* PHP-5.5:
  Reduce compiler noise by removing unused variables and labels
2013-08-14 21:08:55 -07:00
Christopher Jones
cd14de94d2 Reduce compiler noise by removing unused variables and labels 2013-08-14 21:06:59 -07:00
Veres Lajos
e9a95d78ef typo fixes 2013-07-15 00:23:03 -07:00
Veres Lajos
1b06e0be96 typo fixes 2013-07-15 00:19:49 -07:00
Veres Lajos
72085b0e5f typo fixes 2013-07-15 00:18:57 -07:00
Remi Collet
6c56d785ae Merge branch 'PHP-5.5'
* PHP-5.5:
  Upstream fix from https://bitbucket.org/libgd/gd-libgd/issue/75
2013-06-24 11:04:10 +02:00
Remi Collet
b4632d0c12 Upstream fix from https://bitbucket.org/libgd/gd-libgd/issue/75 2013-06-24 11:03:12 +02:00
Pierre Joye
a1d0a869be Merge branch 'PHP-5.5'
* PHP-5.5:
  fix #65070, bgcolor does not use the same format as the input image with imagerotate
  fix #65070, bgcolor does not use the same format as the input image with imagerotate
  Fix the spelling of the php_cli_server_http_response_status_code_pair typedef.
  Change the search in get_status_string() to correctly handle unknown codes.
  Update git rules (5.5 is stable, 5.3 sec only)
  skip test for bug #64936 when tokenizer not built
  Bump version
  Update credits
  Merge NEWS from PHP 5.4 branch
  Reorder NEWS for PHP 5.5.0 final

Conflicts:
	configure.in
	ext/gd/libgd/gd_interpolation.c
	main/php_version.h
2013-06-20 22:32:52 +02:00
Pierre Joye
07e52857b5 fix #65070, bgcolor does not use the same format as the input image with imagerotate 2013-06-20 22:19:33 +02:00
Remi Collet
57dd91be82 Merge branch 'PHP-5.5'
* PHP-5.5:
  Fixed Bug #64962 	imagerotate produce corrupted image
2013-06-03 15:02:43 +02:00
Remi Collet
3579e81200 Fixed Bug #64962 imagerotate produce corrupted image
See https://bitbucket.org/libgd/gd-libgd/issue/67/problem-with-gdrotate

This computation need to be done in signed range.
2013-06-03 15:01:48 +02:00
Pierre Joye
8059ec1832 Merge branch 'PHP-5.5'
* PHP-5.5:
  fix #64898imagerotate is broken with bilinear interpolation
2013-05-27 09:22:00 +02:00
Pierre Joye
2f01e06786 fix #64898imagerotate is broken with bilinear interpolation 2013-05-27 09:21:41 +02:00
Remi Collet
71e76816ce Merge branch 'PHP-5.5'
* PHP-5.5:
  NEWS
  fix build with bundled libgd
  Move png and jpeg version functions to gd.c so the external library build doesn't include anything from libgd/.
  Remove extra unused functions from gd_compat.h
  Rewrite Xpm library check so it doesn't break on MultiArch systems
  Required GD >= 2.1.0 or GD bundled, this allows us to remove most of the #ifdef
  * Remove overflow2, getmbi and skipheaders from gd_compat.h * Add missing return in _php_ctx_getmbi * Reintroduce imagecreatefromxbm by checking for gdCreateImageFromXbm
  Remove overflow2, getmbi and skipheader, since they are not needed anymore.
  Allow to use new GD-2.1.0 function from system library
2013-05-04 16:54:46 +02:00
Ondřej Surý
2a2ac5f2be Move png and jpeg version functions to gd.c so the external library build doesn't include anything from libgd/. 2013-05-04 16:50:13 +02:00
Ondřej Surý
e6704501f8 Remove extra unused functions from gd_compat.h 2013-05-04 16:50:11 +02:00
Ondřej Surý
2fc17d83cb * Remove overflow2, getmbi and skipheaders from gd_compat.h * Add missing return in _php_ctx_getmbi * Reintroduce imagecreatefromxbm by checking for gdCreateImageFromXbm 2013-05-04 16:50:03 +02:00
Ondřej Surý
8a07908215 Remove overflow2, getmbi and skipheader, since they are not needed anymore. 2013-05-04 16:49:59 +02:00
Ondřej Surý
6aedadce0a Allow to use new GD-2.1.0 function from system library 2013-05-04 16:49:35 +02:00
Pierre Joye
fc666bdb83 Merge branch 'PHP-5.5'
* PHP-5.5:
  fix #64738, fix implicit type declaration
2013-04-30 08:03:46 +02:00
Pierre Joye
1a335d20a8 fix #64738, fix implicit type declaration 2013-04-30 07:52:40 +02:00
Pierre Joye
bba7f8aa31 Merge branch 'PHP-5.5'
* PHP-5.5:
  - #64710, check return val
  - #64710, kill unused var
  #64710, kill unused vars
  #64710, kill unused vars
  #64710, kill unused vars
  #64710, kill unused vars
  #64710, kill unused vars
  #64710, Implicit declaration
2013-04-26 08:16:02 +02:00
Pierre Joye
7bd20354a8 - #64710, kill unused var 2013-04-26 08:15:05 +02:00
Pierre Joye
685a6d9aab #64710, kill unused vars 2013-04-26 08:09:19 +02:00
Pierre Joye
b5902b6c9d #64710, kill unused vars 2013-04-26 08:06:34 +02:00
Remi Collet
182fef46a9 Fixed bug #64707 missing declaration after dd0399f 2013-04-25 06:40:55 +02:00
Remi Collet
dd0399f5c6 We need both gdImageCreateFromJpeg* and gdImageCreateFromJpeg*Ex
The new (Ex) functions are used with the new ignore_warning parameter

The standard functions are used in _php_image_create_from_string,
sent as a function pointer, and call without this optional parameter.
2013-04-24 16:07:50 +02:00
Remi Collet
b0cf340eef Merge branch 'PHP-5.5'
* PHP-5.5:
  Fixed bug #64707 missing declaration after dd0399f
2013-04-25 06:41:01 +02:00
Remi Collet
5897696a02 Merge branch 'PHP-5.5'
* PHP-5.5:
  We need both gdImageCreateFromJpeg* and gdImageCreateFromJpeg*Ex
  gd: fix proto comment
2013-04-24 16:11:34 +02:00
Remi Collet
2fa178fa41 Merge branch 'PHP-5.5'
* PHP-5.5:
  enable WebP with system libgd when available
  (re)allow WBMP detection with system libgd provide getbmi and skipheader not exported functions in gd_compat.
2013-04-23 13:46:24 +02:00
Remi Collet
eb50789910 (re)allow WBMP detection with system libgd
provide getbmi and skipheader not exported functions in gd_compat.
2013-04-23 13:43:57 +02:00
Remi Collet
149cf2650a Merge branch 'PHP-5.5'
* PHP-5.5:
  overflow2 is not exported by system libgd
2013-04-22 17:39:54 +02:00
Remi Collet
6889a0d1f5 overflow2 is not exported by system libgd 2013-04-22 17:39:35 +02:00
Pierre Joye
ca1962949e Merge branch 'PHP-5.5'
* PHP-5.5:
  add external 2.1 detection and fix gd_compat for 2.1+
2013-04-10 20:14:00 +02:00
Pierre Joye
87f5d9aa1b Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  add external 2.1 detection and fix gd_compat for 2.1+
2013-04-10 20:13:46 +02:00
Pierre Joye
c480bf3fb2 Merge branch 'PHP-5.3' into PHP-5.4
* PHP-5.3:
  add external 2.1 detection and fix gd_compat for 2.1+
2013-04-10 20:13:18 +02:00
Pierre Joye
224a67fb9f add external 2.1 detection and fix gd_compat for 2.1+ 2013-04-10 20:12:25 +02:00
Pierre Joye
d0cd049312 Merge branch 'PHP-5.5'
* PHP-5.5:
  fix possible NULL deref
2013-04-09 10:09:54 +02:00
Pierre Joye
24f1045d55 Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
  fix possible NULL deref
2013-04-09 10:09:47 +02:00
Pierre Joye
aab5659357 Merge branch 'PHP-5.3' into PHP-5.4
* PHP-5.3:
  fix possible NULL deref
2013-04-09 10:09:36 +02:00
Pierre Joye
88b3cdc4e9 fix possible NULL deref 2013-04-09 10:09:17 +02:00
Pierre Joye
f4308084d8 Merge branch 'PHP-5.5'
# By Pierre Joye (1) and Rasmus Lerdorf (1)
* PHP-5.5:
  fix null deref
  Fixed bugs #47675 and #64577 (fd leak on Solaris)
2013-04-09 10:04:41 +02:00
Pierre Joye
4d6c367177 Merge branch 'PHP-5.4' into PHP-5.5
# By Pierre Joye (1) and Rasmus Lerdorf (1)
* PHP-5.4:
  fix null deref
  Fixed bugs #47675 and #64577 (fd leak on Solaris)
2013-04-09 10:04:32 +02:00