From a31fe58d8005ff47f8f6ad095dcd4fb3a2f0aae9 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmb@php.net>
Date: Sun, 19 Jul 2015 22:21:56 +0200
Subject: [PATCH 1/2] Fix #70102: imagecreatefromwebm() shifts colors

libgd internally uses ARGB format, so we have to decode to ARGB instead of
RGBA.
---
 ext/gd/libgd/webpimg.c     | 18 +++++++++---------
 ext/gd/tests/bug70102.phpt | 30 ++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 9 deletions(-)
 create mode 100644 ext/gd/tests/bug70102.phpt

diff --git a/ext/gd/libgd/webpimg.c b/ext/gd/libgd/webpimg.c
index 6ce991fbdd0..f287e5414f9 100644
--- a/ext/gd/libgd/webpimg.c
+++ b/ext/gd/libgd/webpimg.c
@@ -57,21 +57,21 @@ static inline int clip(float v, int a, int b) {
   return (v > b) ? b : (v < 0) ? 0 : (int)(v);
 }
 enum {
-    COLOR_RED = 0,
-    COLOR_GREEN = 1,
-    COLOR_BLUE = 2,
-    ALPHA_CHANNEL = 3
+    COLOR_RED = 1,
+    COLOR_GREEN = 2,
+    COLOR_BLUE = 3,
+    ALPHA_CHANNEL = 0
 };
 
-/* endian neutral extractions of RGBA from a 32 bit pixel */
+/* endian neutral extractions of ARGB from a 32 bit pixel */
 static const uint32  RED_SHIFT =
-       8 * (sizeof(uint32) - 1 - COLOR_RED);           /* 24 */
+       8 * (sizeof(uint32) - 1 - COLOR_RED);           /* 16 */
 static const uint32  GREEN_SHIFT =
-       8 * (sizeof(uint32) - 1 - COLOR_GREEN);         /* 16 */
+       8 * (sizeof(uint32) - 1 - COLOR_GREEN);         /*  8 */
 static const uint32  BLUE_SHIFT =
-       8 * (sizeof(uint32) - 1 - COLOR_BLUE);          /*  8 */
+       8 * (sizeof(uint32) - 1 - COLOR_BLUE);          /*  0 */
 static const uint32  ALPHA_SHIFT =
-       8 * (sizeof(uint32) - 1 - ALPHA_CHANNEL);       /*  0 */
+       8 * (sizeof(uint32) - 1 - ALPHA_CHANNEL);       /* 24 */
 
 static inline int GetRed(const uint32* rgba) {
 	return gdTrueColorGetRed(*rgba);
diff --git a/ext/gd/tests/bug70102.phpt b/ext/gd/tests/bug70102.phpt
new file mode 100644
index 00000000000..b82c757ebe0
--- /dev/null
+++ b/ext/gd/tests/bug70102.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Bug #70102 (imagecreatefromwebm() shifts colors)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!function_exists('imagewebp') || !function_exists('imagecreatefromwebp'))
+    die('skip WebP support not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ .  '/bug70102.webp';
+
+$im = imagecreatetruecolor(8, 8);
+$white = imagecolorallocate($im, 255, 255, 255);
+var_dump($white & 0xffffff);
+imagefilledrectangle($im, 0, 0, 7, 7, $white);
+imagewebp($im, $filename);
+imagedestroy($im);
+
+$im = imagecreatefromwebp($filename);
+$color = imagecolorat($im, 4, 4);
+var_dump($color & 0xffffff);
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . '/bug70102.webp');
+?>
+--EXPECT--
+int(16777215)
+int(16777215)

From 4b2d025937769d383e6a842a90658c58f10d5794 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmb@php.net>
Date: Sun, 19 Jul 2015 22:39:18 +0200
Subject: [PATCH 2/2] updated NEWS

---
 NEWS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/NEWS b/NEWS
index 7a9379c672e..71b744b4c08 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,7 @@ PHP                                                                        NEWS
   . Fixed bug #64878 (304 responses return Content-Type header). (cmb)
   
 - GD:
+  . Fixed bug #70102 (imagecreatefromwebm() shifts colors). (cmb)
   . Fixed bug #66590 (imagewebp() doesn't pad to even length). (cmb)
   . Fixed bug #66882 (imagerotate by -90 degrees truncates image by 1px). (cmb)
   . Fixed bug #70064 (imagescale(..., IMG_BICUBIC) leaks memory). (cmb)