Commit Graph

60 Commits

Author SHA1 Message Date
Christoph M. Becker
fc989fc6e7 Fix #73279: Integer overflow in gdImageScaleBilinearPalette()
The color components are supposed to be in range 0..255, so we must not
cast them to `signed char`, what can be the default for `char`.

Port of <https://github.com/libgd/libgd/commit/77c8d359>.
2016-10-10 11:41:39 +02:00
Christoph M. Becker
88838dd282 Fix #68712: suspicious if-else statements 2016-07-23 19:29:43 +02:00
Christoph M. Becker
9fbd0c1ff1 Fix copy&paste errors in gd_interpolation.c
According to <https://github.com/libgd/libgd/commit/f101380>.
2016-07-23 18:09:18 +02:00
Pierre Joye
48e76abadd improve fix #72558, free contribRow as well 2016-07-19 16:33:17 +07:00
Pierre Joye
df09515089 improve fix #72558, while (u>=0) with unsigned int will always be true 2016-07-19 15:51:43 +07:00
Stanislav Malyshev
f69362d212 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Fix memory leak
2016-07-19 01:47:40 -07:00
Stanislav Malyshev
47d6ea6332 Fix memory leak 2016-07-19 01:47:27 -07:00
Stanislav Malyshev
4d0565b5ba Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix #72519, possible OOB using imagegif
  fix #72512, invalid read or write for palette image when invalid transparent index is used
  Apparently some envs miss SIZE_MAX
  Fix tests
  Fix bug #72618: NULL Pointer Dereference in exif_process_user_comment
  Partial fix for bug #72613 - do not treat negative returns from bz2 as size_t
  Fix bug #72606: heap-buffer-overflow (write) simplestring_addn simplestring.c
  Fix for bug #72558, Integer overflow error within _gdContributionsAlloc()
  Fix bug #72603: Out of bound read in exif_process_IFD_in_MAKERNOTE
  Fix bug #72562 - destroy var_hash properly
  Fix bug #72533 (locale_accept_from_http out-of-bounds access)
  Fix fir bug #72520
  Fix for bug #72513
  CS fix and comments with bug ID
  Fix for HTTP_PROXY issue.
  add tests for bug #72512
  Fixed bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access
  Fixed bug #72479 - same as #72434

Conflicts:
	ext/bz2/bz2.c
	main/SAPI.c
	main/php_variables.c
2016-07-19 00:53:08 -07:00
Pierre Joye
928aecc002 fix #72512, invalid read or write for palette image when invalid transparent index is used
Conflicts:
	ext/gd/libgd/gd.c
2016-07-19 00:37:38 -07:00
Pierre Joye
511f07b747 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix #72512, invalid read or write for palette image when invalid transparent index is used
2016-07-19 13:39:46 +07:00
Pierre Joye
0fbcff1b35 fix #72512, invalid read or write for palette image when invalid transparent index is used 2016-07-19 13:37:23 +07:00
Stanislav Malyshev
d1a491acf3 Fix for bug #72558, Integer overflow error within _gdContributionsAlloc() 2016-07-18 00:17:48 -07:00
Stanislav Malyshev
7dde353ee7 Merge branch 'PHP-5.5' into PHP-5.6.23
* PHP-5.5:
  Fixed bug #72446 - Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow
  update NEWS
  fix tests
  fix build
  Fix bug #72455:  Heap Overflow due to integer overflows
  Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fixed ##72433: Use After Free Vulnerability in PHP's GC algorithm and unserialize
  Fix bug #72407: NULL Pointer Dereference at _gdScaleVert
  Fix bug #72402: _php_mb_regex_ereg_replace_exec - double free
  Fix bug #72298	pass2_no_dither out-of-bounds access
  Fixed #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
  Fix bug #72262 - do not overflow int
  Fix bug #72400 and #72403 - prevent signed int overflows for string lengths
  Fix bug #72275: don't allow smart_str to overflow int
  Fix bug #72340: Double Free Courruption in wddx_deserialize
  update NEWS
  Fix #66387: Stack overflow with imagefilltoborder
  Skip test which is 64bits only
  5.5.37 now

Conflicts:
	configure.in
	ext/mcrypt/mcrypt.c
	ext/spl/spl_directory.c
	main/php_version.h
2016-06-21 00:01:48 -07:00
Stanislav Malyshev
b9ec171e7d Fix bug #72407: NULL Pointer Dereference at _gdScaleVert 2016-06-18 21:57:25 -07:00
Pierre Joye
f80125950c #72337 invalid dimensions can lead to segv 2016-06-07 17:16:40 +07:00
Stanislav Malyshev
544940c48a Merge branch 'PHP-5.5' into PHP-5.6.22
* PHP-5.5:
  Fix memory leak in imagescale()
  Update NEWS
  Better fix for bug #72135
  Fixed bug #72227: imagescale out-of-bounds read
  Fix bug #72241: get_icu_value_internal out-of-bounds read
  Fix bug #72135 - don't create strings with lengths outside int range
  Add check for string overflow to all string add operations
  Fix bug #72114 - int/size_t confusion in fread
  Updated NEWS
  Fixed bug #71331 - Uninitialized pointer in phar_make_dirstream()

Conflicts:
	Zend/zend_operators.c
	ext/phar/dirstream.c
	ext/phar/tests/bug71331.phpt
2016-05-24 16:56:36 -07:00
Stanislav Malyshev
9a826a3bd9 Fix memory leak in imagescale() 2016-05-24 16:12:01 -07:00
Stanislav Malyshev
7a1aac3343 Fixed bug #72227: imagescale out-of-bounds read
Ported from 4f65a3e4ee
2016-05-23 00:34:35 -07:00
Remi Collet
aa8d3a8cc6 fix the fix for bug #70976 (imagerotate) 2016-01-12 14:03:35 +01:00
Remi Collet
14e4d393cf fix the fix for bug #70976 (imagerotate) 2016-01-12 13:52:27 +01:00
Stanislav Malyshev
13750cb0a1 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Update NEWS
  Improve fix for bug #70976
  Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization)
  Fixed bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
  Fixed #70728
  Fixed bug #70755: fpm_log.c memory leak and buffer overflow
  Fix bug #70976: fix boundary check on gdImageRotateInterpolated
  typofix
2016-01-05 19:38:29 -08:00
Stanislav Malyshev
2baeb167a0 Improve fix for bug #70976 2015-12-28 23:44:14 -08:00
Stanislav Malyshev
4bb422343f Fix bug #70976: fix boundary check on gdImageRotateInterpolated 2015-12-07 23:33:05 -08:00
Christoph M. Becker
2e34febb73 Fix #66882: imagerotate by -90 degrees truncates image by 1px
Contrary to the external libgd, the bundled libgd doesn't use optimized
rotation algorithms for negative square angles. We fix that now.

There are other improvements in gdImageRotateInterpolated() in the external
libgd. I'll leave them out for now, in the hope that we'll be able to rejoin
the two libraries rather soon.
2015-07-13 22:18:56 +02:00
Christoph M. Becker
1a4722a89e Fix #70064: imagescale(..., IMG_BICUBIC) leaks memory
A temporary image (tmp_im) is created with gdImageTrueColor() and freed with
gdFree() instead of gdImageDestroy(). Let's fix that.
2015-07-13 18:30:33 +02:00
Christoph M. Becker
fa53d8463f Fix #69024: imagescale segfault with palette based image
imagescale(..., IMG_BICUBIC) is not supposed to work with palette images, so we
fix that by converting to true color if necessary. Basically the same fix has
already been applied to the external libgd[1].

[1] <723ea520be>
2015-07-13 15:48:48 +02:00
Remi Collet
44c0581e0c Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  NEWS
  Fix bug  #66887 imagescale - poor quality of scaled image
2014-03-12 17:13:31 +01:00
Remi Collet
862c006da1 Fix bug #66887 imagescale - poor quality of scaled image
Issue with signed char overflow.

Upstream fix:
4b86e06937
2014-03-12 17:10:51 +01:00
Remi Collet
5bd13c5231 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Fixed Bug #66893i imagescale ignore method argument
2014-03-12 15:36:08 +01:00
Remi Collet
f2d5b2b6c6 Fixed Bug #66893i imagescale ignore method argument
We also have our goto fail; bug.

Upstream fix for libgd
5b42b1178c
2014-03-12 15:35:42 +01:00
unknown
d32194172a Merge branch 'PHP-5.5'
* PHP-5.5:
  ensure that the defined interpolation method is used by the generic scaling functions
2013-09-09 11:56:58 +02:00
unknown
b54b6e30a4 ensure that the defined interpolation method is used by the generic scaling functions 2013-09-09 11:56:05 +02:00
Pierre Joye
a1d0a869be Merge branch 'PHP-5.5'
* PHP-5.5:
  fix #65070, bgcolor does not use the same format as the input image with imagerotate
  fix #65070, bgcolor does not use the same format as the input image with imagerotate
  Fix the spelling of the php_cli_server_http_response_status_code_pair typedef.
  Change the search in get_status_string() to correctly handle unknown codes.
  Update git rules (5.5 is stable, 5.3 sec only)
  skip test for bug #64936 when tokenizer not built
  Bump version
  Update credits
  Merge NEWS from PHP 5.4 branch
  Reorder NEWS for PHP 5.5.0 final

Conflicts:
	configure.in
	ext/gd/libgd/gd_interpolation.c
	main/php_version.h
2013-06-20 22:32:52 +02:00
Pierre Joye
07e52857b5 fix #65070, bgcolor does not use the same format as the input image with imagerotate 2013-06-20 22:19:33 +02:00
Remi Collet
57dd91be82 Merge branch 'PHP-5.5'
* PHP-5.5:
  Fixed Bug #64962 	imagerotate produce corrupted image
2013-06-03 15:02:43 +02:00
Remi Collet
3579e81200 Fixed Bug #64962 imagerotate produce corrupted image
See https://bitbucket.org/libgd/gd-libgd/issue/67/problem-with-gdrotate

This computation need to be done in signed range.
2013-06-03 15:01:48 +02:00
Pierre Joye
8059ec1832 Merge branch 'PHP-5.5'
* PHP-5.5:
  fix #64898imagerotate is broken with bilinear interpolation
2013-05-27 09:22:00 +02:00
Pierre Joye
2f01e06786 fix #64898imagerotate is broken with bilinear interpolation 2013-05-27 09:21:41 +02:00
Pierre Joye
fc666bdb83 Merge branch 'PHP-5.5'
* PHP-5.5:
  fix #64738, fix implicit type declaration
2013-04-30 08:03:46 +02:00
Pierre Joye
1a335d20a8 fix #64738, fix implicit type declaration 2013-04-30 07:52:40 +02:00
Pierre Joye
396b1109cf Merge branch 'PHP-5.5'
* PHP-5.5:
  ws and comment for recommended aa method
2013-04-09 07:05:03 +02:00
Pierre Joye
83500123d0 ws and comment for recommended aa method 2013-04-09 07:04:52 +02:00
Pierre Joye
21cfbdf42c Merge branch 'PHP-5.5'
* PHP-5.5:
  fix some unitialized values and typo
2013-04-09 06:45:24 +02:00
Pierre Joye
85ad65ef40 fix some unitialized values and typo 2013-04-09 06:44:45 +02:00
Pierre Joye
8a85da4a61 merging conflict left over 2013-03-26 17:46:29 +01:00
Pierre Joye
111123af4f conflict 2013-03-26 11:24:00 +01:00
Pierre Joye
5ae6f582fb fix regression, take #2 (merge issue due to git 1.8 default setting changes) 2013-03-26 11:23:15 +01:00
Stanislav Malyshev
c1ac5a20a5 fix typo 2013-03-24 20:04:24 -07:00
Stanislav Malyshev
504ef64c7b fix typo 2013-03-24 20:03:57 -07:00
Pierre Joye
f21f37bb4c Merge branch 'PHP-5.5'
* PHP-5.5:
  remove comments
2013-03-25 03:14:40 +01:00