1
0
mirror of https://github.com/php/php-src.git synced 2026-04-21 06:51:18 +02:00
Commit Graph

1402 Commits

Author SHA1 Message Date
Christoph M. Becker
5049ef2f1c Fix #73549: Use after free when stream is passed to imagepng
If a stream is passed to imagepng() or other image output functions,
opposed to a filename, we must not close this stream.
2016-11-27 14:51:02 -08:00
Christoph M. Becker
7f529e3dee Fix #73582: Failing ext/gd/tests/imagettftext_charmap_order.phpt
This test is not supposed to work with JIS-mapped Japanese font support
enabled.
2016-11-25 23:14:08 +01:00
Anatol Belski
33766347cb Merge remote-tracking branch 'phpsec/PHP-5.6.28' into PHP-5.6 2016-11-08 11:06:52 +01:00
Christoph M. Becker
863d37ea66 Fix #72696: imagefilltoborder stackoverflow on truecolor images
We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.
2016-10-30 14:31:29 -07:00
Christoph M. Becker
6499581af7 Fix #72482: Ilegal write/read access caused by gdImageAALine overflow
Instead of rolling our own bounds check we use clip_1d() as it's done
in gdImageLine() and in external libgd. We must not pass the image
width and height, respectively, but rather the largest ordinate value
that is allowed to be accessed, i.e. width-1 and height-1,
respectively.
2016-10-30 14:28:23 -07:00
Christoph M. Becker
cd13d0260a Fix #72494: imagecropauto out-of-bounds access
This issue has actually already been fixed with commit 46f2c690. We're
adding a regression test and a NEWS entry, and also port the fix in
gdImageCropThreshold() from libgd:
  * <https://github.com/libgd/libgd/commit/b347e034>
  * <https://github.com/libgd/libgd/commit/46f2c690>
2016-10-25 14:29:48 +02:00
Christoph M. Becker
cc08cbc84d Fix #73280: Stack Buffer Overflow in GD dynamicGetbuf
We make sure to never pass a negative `rlen` as size to memcpy().

Cf. <https://github.com/libgd/libgd/commit/53110871>.
2016-10-13 11:10:02 +02:00
Christoph M. Becker
fc989fc6e7 Fix #73279: Integer overflow in gdImageScaleBilinearPalette()
The color components are supposed to be in range 0..255, so we must not
cast them to `signed char`, what can be the default for `char`.

Port of <https://github.com/libgd/libgd/commit/77c8d359>.
2016-10-10 11:41:39 +02:00
Christoph M. Becker
b92216b97d Fix #73272: imagescale() affects imagesetinterpolation()
We must not permanently change the interpolation method, but rather
have to restore the old method after we're done with scaling the image.
2016-10-09 15:10:34 +02:00
Christoph M. Becker
9acfb1a3a5 Fix #73213: Integer overflow in imageline() with antialiasing
We port the respective fixes <https://github.com/libgd/libgd/commit/eca37d620>
and <https://github.com/libgd/libgd/commit/837b7327> to our bundled libgd.
2016-09-30 23:38:13 +02:00
Christoph M. Becker
c696bc8cfa Fix test_image_equals_file() wrt. palette images
The recently introduced test_image_equals_file() doesn't properly work for
palette images, because in this case only the palette indexes are compared,
what can lead to false positives and negatives as shown in the added test.

To fix that we convert palette images to truecolor, what is supposed to be
faster than calling imagecolorsforindex() for each pixel.

We furthermore rely on PHP's refcounting to free unused images; after all,
this is not C.
2016-09-25 10:34:03 +02:00
Christoph M. Becker
8f5eda4bf6 Fix #73161: imagecreatefromgd2() may leak memory 2016-09-24 12:36:54 +02:00
Christoph M. Becker
709731797c Fix #73159: imagegd2(): unrecognized formats may result in corrupted files
We must not apply the format correction twice for truecolor images.
2016-09-24 11:28:20 +02:00
Christoph M. Becker
c7936ead8f Fix #73155: imagegd2() writes wrong chunk sizes on boundaries 2016-09-24 10:33:49 +02:00
Christoph M. Becker
1da79a6c6e Fix #73157 (again): imagegd2() ignores 3rd param if 4 are given
Obviously, there was a bad merge.
2016-09-24 00:35:24 +02:00
Christoph M. Becker
726c5999eb Rework FreeType related tests
Firstly, there is no fundamental difference between running the tests on
freetype before and after 2.4.10, so we re-join the respective test cases.

Secondly, there are some minor differences in the results depending on
architecture, freetype versions and config options, so we cater to that
by allowing small deviations from the expectations.
2016-09-23 12:00:41 +02:00
Christoph M. Becker
fc2cadca2d Merge branch 'pull-request/1845' into PHP-5.6 2016-09-20 01:05:57 +02:00
Christoph M. Becker
46df064261 Fix #73003: Integer Overflow in gdImageWebpCtx of gd_webp.c
We add the missing integer overflow check to avoid potential buffer overflows.
2016-09-16 11:37:18 +02:00
Christoph M. Becker
7bfb7b62b1 Fix and reactivate regression test for bug #50194
Apparently, different FreeType versions render the string differently, so
we have to cater to these slight differences. Unfortunately, the testing
framework doesn't yet offer a clean API for this, so we work around the
limitations by parsing and checking the output of test_image_equals_file().
2016-09-15 00:46:00 +02:00
Christoph M. Becker
36df4f8419 Skip ext/gd/tests/bug50194.phpt for now
There are apparently issues with the font rendering with different freetype
version; I'll have a look at this issue ASAP.
2016-09-14 20:00:30 +02:00
Christoph M. Becker
09eb6ed35e Fix #50194: imagettftext broken on transparent background w/o alphablending
We must not draw the background pixels of the character glyphs, what has
already been fixed in GD 2.0.26.
2016-09-14 15:47:32 +02:00
Christoph M. Becker
0cbf634657 Skip regression test for issue that has not yet been released in libgd
<https://github.com/libgd/libgd/issues/177> has been assessed as enhancement,
so most likely it will be released with GD 2.3.
2016-09-12 13:21:34 +02:00
Christoph M. Becker
fcdc30b347 Skip test for external GD because of not yet published bugfix 2016-09-12 12:34:11 +02:00
Christoph M. Becker
6d0e773292 Skip tests for unpatched external libgd regarding libvpx
Some issues have never been fixed in the external libgd's libvpx binding,
so we skip the respective tests.
2016-09-11 23:49:09 +02:00
Christoph M. Becker
6ef987e012 Split test for bundled vs. external libgd
The behavior of imagecropauto($im, IMG_CROP_DEFAULT) is rather different
for the bundled and an external libgd, see
<https://github.com/libgd/libgd/issues/298>.
Therefore we split the test for now.
2016-09-11 19:30:55 +02:00
Christoph M. Becker
38455293f7 Make test case more resilient
This test case fails with external libgd, because libgd < 2.2.4 converts
palette images to truecolor (<https://github.com/libgd/libgd/issues/297>).

However, even if there happens no truecolor conversion, it is not guaranteed
that the palette indexes of the original and the cropped image are identical
(this is, for instance, not the case with current libgd master where the bug
has been fixed). Therefore we check for the expected RGBA value instead of
the palette index.
2016-09-11 18:29:27 +02:00
Christoph M. Becker
dc09f30933 A picture is worth a thousand message digests
The bundled GD test suites makes heavy use of md5() to verify the result
of drawing operations. This leads to fragile tests (even a slight change
in a PNG header would cause failure, and of course there is the
possibility of collisions), and even worse, eventual test failures are
rather unrevealing.

Therefore we replace all md5() verification with a simplistic
test_image_equals_file(), which is basically a simplified port of libgd's
gdTestImageCompareToFile(), adapted to the needs of PHPTs.

In the long run better tests helpers should be introduced (see also
<http://news.php.net/php.internals/94081>), but for now this solution
is preferable over the former.

(cherry picked from commit 24f9e96792)
2016-09-11 12:56:53 +02:00
Christoph M. Becker
d582241368 Fix #67325: imagetruecolortopalette: white is duplicated in palette
gdImageTrueColorToPalette() is sometimes wasteful by putting multiple white
color entries into the palette. This is caused by an obvious typo, where
to avoid a division by zero when `total` is zero, `count` is checked instead
of `total`.

We fix this issue to improve the quality of the color quantization.

Cf. <https://github.com/libgd/libgd/commit/24b4550f>
2016-09-03 19:50:42 +02:00
Christoph M. Becker
bca913d70a Fix proto comment
While we're at it, we also change a related comment to use American English
consistently.
2016-09-03 13:41:29 +02:00
Christoph M. Becker
6a232c3604 Fix #68716: possible resource leaks in _php_image_convert()
We properly clean up after ourselves wrt. to closing opened file pointers
and created images.
2016-08-21 19:39:58 +02:00
Christoph M. Becker
d65adac2be Fix #72913: imagecopy() loses single-color transparency on palette images
The proper code to handle true-color to palette copies is already contained
in gdImageCopy(), so we can simply remove the buggy duplicated code.
2016-08-21 17:39:23 +02:00
Christoph M. Becker
9eb5bbd8bd Fix #66005: imagecopy does not support 1bit transparency on truecolor images
We must not copy transparent pixels, see
<https://github.com/libgd/libgd/commit/daac285c>.
2016-08-21 16:08:57 +02:00
Christoph M. Becker
54293d21cb Skip tests that are supposed to fail due to bugs in old external libgd 2016-08-17 21:36:26 +02:00
Christoph M. Becker
a3159d29bb Make tests a little more resilient
PNG allows identical images to be stored differently what makes nearly all
tests checking the MD5 hash of the PNG representation fail with external
libgd. For now, we use the GD format instead, which doesn't allow for such
differences.

Of course, this md5() checking should be replaced by a image diffing feature
in the long run.
2016-08-17 17:59:33 +02:00
Stanislav Malyshev
d8b2de164e fix tests 2016-08-16 22:55:43 -07:00
Stanislav Malyshev
1bd103df00 Fix bug #72730 - imagegammacorrect allows arbitrary write access 2016-08-16 22:55:40 -07:00
Stanislav Malyshev
a3598dd7c9 Fix bug#72697 - select_colors write out-of-bounds 2016-08-16 22:55:40 -07:00
Anatol Belski
fad3f936ac fix ts build 2016-08-03 12:16:42 +02:00
Christoph M. Becker
f5622f5c87 Fix #72709: imagesetstyle() causes OOB read for empty $styles
Calling imagesetstyle() with an empty $styles array caused gdImageSetStyle()
to be called with `noOfPixels==0`, what could have lead to OOB reads.
Actually, this issue will be fixed in libgd, but to avoid issues when older
libgd is in use, we simply disallow passing an empty $styles array to
imagesetstyle(), what wouldn't serve a useful purpose anyway.
2016-08-02 18:43:37 +02:00
Christoph M. Becker
305bddb0ed Fix broken test case
d28f1da introduced a test regression, due to potentially additional output
regarding FreeType support. We fix that by making the test more resilient.
2016-07-25 02:00:37 +02:00
Christoph M. Becker
d28f1dae9d Fix broken test case
The test claims that it would be "checking all the values in returned array",
but due to the use of %a it actually skipped elements. We fix that by using
%s instead.
2016-07-25 00:13:44 +02:00
Christoph M. Becker
88838dd282 Fix #68712: suspicious if-else statements 2016-07-23 19:29:43 +02:00
Christoph M. Becker
9fbd0c1ff1 Fix copy&paste errors in gd_interpolation.c
According to <https://github.com/libgd/libgd/commit/f101380>.
2016-07-23 18:09:18 +02:00
Christoph M. Becker
2c16b9cf62 Fix #66555: Always false condition in ext/gd/libgd/gdkanji.c
This issue has already been fixed in libgd[1], so we fix PHP's bundled
libgd accordingly.

[1] <https://github.com/libgd/libgd/commit/aa1d71c>
2016-07-23 16:48:07 +02:00
Pierre Joye
e8b768dd92 Merge branch 'PHP-5.6' of git.php.net:php-src into PHP-5.6 2016-07-20 00:18:56 +07:00
Pierre Joye
9cc0a5a9a9 #72482, revert for 5.6 for now 2016-07-20 00:18:25 +07:00
Christoph M. Becker
828f911efd Fix #43828: broken transparency of imagearc for truecolor in blendingmode
No pixel of a filled arc must ever be drawn multiple times. Otherwise we get
artifacts regarding transparency. That happens with the current
implementation of gdImageFilledArc() unless gdChord or gdNoFill are set.
When gdPie is set, however, the filled arc is drawn in wedges, which are
polygons of three points, and so some overlap is natural.

To resolve the issue, we stick with the current algorithm of calculating the
wedges, but instead of drawing each polygon separately, we put the relevant
points in a large array, and draw a single polygon. That also is supposed to
improve the performance considerably.

Note that this modification will change the results when gdImageSetStyle()
or gdImageSetBrush() are used, but we believe that this modification is also
an improvement in this regard, even though it still might not make much
sense to use these functions with gdImageFilledArc().

The respective fix for libgd is
<https://github.com/libgd/libgd/commit/e7e20d6>.
2016-07-19 17:38:26 +02:00
Pierre Joye
b25009fc2c #72482, Ilegal write/read access caused by gdImageAALine overflow 2016-07-19 19:34:07 +07:00
Pierre Joye
1d69028d2f fix #72494, improve input color check and prevent issues when old gd are used, done before gd call 2016-07-19 18:23:51 +07:00
Pierre Joye
48e76abadd improve fix #72558, free contribRow as well 2016-07-19 16:33:17 +07:00