From 2d1c3825a8ee468fe04efcd81ee48df39fa70c51 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Thu, 14 Nov 2024 14:00:19 +0100
Subject: [PATCH] Simplify WBMP imagecreatefromstring() detection (GH-16782)

According to the WBMP specification[1], the first field (type) of a
WBMP is a multi-byte integer, but only type `0` is supported.  Thus
there is no need to read a multi-byte integer.  The second field (fix
header) is a single byte; reading a multi-byte integer is not really
wrong, since the fix header field is laid out in a way which allows it
to be treated as such, but the check whether the MBI is greater than
or equal to zero is pretty useless, because negative values could only
be returned if overflow occurs (MBIs are unsigned).

So the only useful assumption we can make is that the first byte is
zero; we let `gdImageCreateFromWBMPCtx()` figure out the rest.

[1] <https://www.wapforum.org/what/technical/SPEC-WAESpec-19990524.pdf> section 6
---
 ext/gd/gd.c                                  |  29 ++-----------------
 ext/gd/tests/imagecreatefromstring.wbmp      | Bin 0 -> 5006 bytes
 ext/gd/tests/imagecreatefromstring_wbmp.phpt |  19 ++++++++++++
 3 files changed, 21 insertions(+), 27 deletions(-)
 create mode 100644 ext/gd/tests/imagecreatefromstring.wbmp
 create mode 100644 ext/gd/tests/imagecreatefromstring_wbmp.phpt

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 093daeac419..938672ccc0c 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1358,24 +1358,6 @@ PHP_FUNCTION(imagetypes)
 }
 /* }}} */
 
-/* {{{ _php_ctx_getmbi */
-
-static int _php_ctx_getmbi(gdIOCtx *ctx)
-{
-	int i, mbi = 0;
-
-	do {
-		i = (ctx->getC)(ctx);
-		if (i < 0 || mbi > (INT_MAX >> 7)) {
-			return -1;
-		}
-		mbi = (mbi << 7) | (i & 0x7f);
-	} while (i & 0x80);
-
-	return mbi;
-}
-/* }}} */
-
 /* {{{ _php_image_type
  * Based on ext/standard/image.c
  */
@@ -1413,15 +1395,8 @@ static int _php_image_type(zend_string *data)
 		}
 	}
 
-	gdIOCtx *io_ctx;
-	io_ctx = gdNewDynamicCtxEx(8, ZSTR_VAL(data), 0);
-	if (io_ctx) {
-		if (_php_ctx_getmbi(io_ctx) == 0 && _php_ctx_getmbi(io_ctx) >= 0) {
-			io_ctx->gd_free(io_ctx);
-			return PHP_GDIMG_TYPE_WBM;
-		} else {
-			io_ctx->gd_free(io_ctx);
-		}
+	if (ZSTR_VAL(data)[0] == 0) {
+		return PHP_GDIMG_TYPE_WBM;
 	}
 
 	return -1;
diff --git a/ext/gd/tests/imagecreatefromstring.wbmp b/ext/gd/tests/imagecreatefromstring.wbmp
new file mode 100644
index 0000000000000000000000000000000000000000..f1af776b7f20c8d01215d644f6342f936d2052f2
GIT binary patch
literal 5006
xcmeIuF#!Mo2m_$STP>4o3O|TIGMz343>YwAz<>b*1`HT5V8DO@0|pGd4;%(RcPIb=

literal 0
HcmV?d00001

diff --git a/ext/gd/tests/imagecreatefromstring_wbmp.phpt b/ext/gd/tests/imagecreatefromstring_wbmp.phpt
new file mode 100644
index 00000000000..07bf3f7e196
--- /dev/null
+++ b/ext/gd/tests/imagecreatefromstring_wbmp.phpt
@@ -0,0 +1,19 @@
+--TEST--
+imagecreatefromstring() - WBMP format
+--EXTENSIONS--
+gd
+--SKIPIF--
+<?php
+if (!(imagetypes() & IMG_WBMP)) die('skip GIF support required');
+?>
+--FILE--
+<?php
+// create an image from a WBMP string representation
+$im = imagecreatefromstring(file_get_contents(__DIR__ . '/imagecreatefromstring.wbmp'));
+var_dump(imagesx($im));
+var_dump(imagesy($im));
+
+?>
+--EXPECT--
+int(200)
+int(200)