* phpsec/PHP-7.0.13:
Fixed bug #73418 Integer Overflow in "_php_imap_mail" leads to crash
Fix#72696: imagefilltoborder stackoverflow on truecolor images
Fix#72482: Ilegal write/read access caused by gdImageAALine overflow
Fix bug #73144 and bug #73341 - remove extra dtor
remove unreferenced var came in with merge
Fix bug #73331 - do not try to serialize/unserialize objects wddx can not handle
fix version
set versions
We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
(cherry picked from commit 863d37ea66)
Instead of rolling our own bounds check we use clip_1d() as it's done
in gdImageLine() and in external libgd. We must not pass the image
width and height, respectively, but rather the largest ordinate value
that is allowed to be accessed, i.e. width-1 and height-1,
respectively.
(cherry picked from commit 6499581af7)
We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
Instead of rolling our own bounds check we use clip_1d() as it's done
in gdImageLine() and in external libgd. We must not pass the image
width and height, respectively, but rather the largest ordinate value
that is allowed to be accessed, i.e. width-1 and height-1,
respectively.
The color components are supposed to be in range 0..255, so we must not
cast them to `signed char`, what can be the default for `char`.
Port of <https://github.com/libgd/libgd/commit/77c8d359>.
The recently introduced test_image_equals_file() doesn't properly work for
palette images, because in this case only the palette indexes are compared,
what can lead to false positives and negatives as shown in the added test.
To fix that we convert palette images to truecolor, what is supposed to be
faster than calling imagecolorsforindex() for each pixel.
We furthermore rely on PHP's refcounting to free unused images; after all,
this is not C.
Firstly, there is no fundamental difference between running the tests on
freetype before and after 2.4.10, so we re-join the respective test cases.
Secondly, there are some minor differences in the results depending on
architecture, freetype versions and config options, so we cater to that
by allowing small deviations from the expectations.
Apparently, different FreeType versions render the string differently, so
we have to cater to these slight differences. Unfortunately, the testing
framework doesn't yet offer a clean API for this, so we work around the
limitations by parsing and checking the output of test_image_equals_file().
The behavior of imagecropauto($im, IMG_CROP_DEFAULT) is rather different
for the bundled and an external libgd, see
<https://github.com/libgd/libgd/issues/298>.
Therefore we split the test for now.
This test case fails with external libgd, because libgd < 2.2.4 converts
palette images to truecolor (<https://github.com/libgd/libgd/issues/297>).
However, even if there happens no truecolor conversion, it is not guaranteed
that the palette indexes of the original and the cropped image are identical
(this is, for instance, not the case with current libgd master where the bug
has been fixed). Therefore we check for the expected RGBA value instead of
the palette index.
