1
0
mirror of https://github.com/php/php-src.git synced 2026-04-21 15:08:16 +02:00
Commit Graph

471 Commits

Author SHA1 Message Date
Anatol Belski f7e81fd9f1 fix double free and move temps into local scope 2016-03-07 16:38:47 +01:00
Anatol Belski 0fccddba75 add error check 2016-03-07 16:26:01 +01:00
Remi Collet af3f3be0c1 Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  fix the fix for bug #70976 (imagerotate)
  Use php_session_abort()
2016-01-12 13:54:23 +01:00
Remi Collet 14e4d393cf fix the fix for bug #70976 (imagerotate) 2016-01-12 13:52:27 +01:00
Stanislav Malyshev 13750cb0a1 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  Update NEWS
  Improve fix for bug #70976
  Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization)
  Fixed bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
  Fixed #70728
  Fixed bug #70755: fpm_log.c memory leak and buffer overflow
  Fix bug #70976: fix boundary check on gdImageRotateInterpolated
  typofix
2016-01-05 19:38:29 -08:00
Stanislav Malyshev 82865dda71 Improve fix for bug #70976 2016-01-04 17:37:54 +01:00
Stanislav Malyshev 84b8db597a Fix bug #70976: fix boundary check on gdImageRotateInterpolated 2016-01-04 17:37:40 +01:00
Lior Kaplan ed35de784f Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
  Happy new year (Update copyright to 2016)
2016-01-01 19:48:25 +02:00
Lior Kaplan 49493a2dcf Happy new year (Update copyright to 2016) 2016-01-01 19:21:47 +02:00
Stanislav Malyshev 2baeb167a0 Improve fix for bug #70976 2015-12-28 23:44:14 -08:00
Stanislav Malyshev 4bb422343f Fix bug #70976: fix boundary check on gdImageRotateInterpolated 2015-12-07 23:33:05 -08:00
Christoph M. Becker f1228ebc61 Merge branch 'pull-request/1425' into PHP-5.6
* pull-request/1425:
  revised bug53156.phpt
  Fix #53156: imagerectangle problem with point ordering
2015-07-21 01:13:04 +02:00
Christoph M. Becker e7f2356665 Fix #66387: Stack overflow with imagefilltoborder
The stack overflow is caused by the recursive algorithm in combination with a
very large negative coordinate passed to gdImageFillToBorder(). As there is
already a clipping for large positive coordinates to the width and height of
the image, it seems to be consequent to clip to zero also.
2015-07-20 23:36:32 +02:00
Christoph M. Becker 72b73e24a0 Fix #53156: imagerectangle problem with point ordering
Contrary to imagefilledrectangle(), imagerectangle() has the documented
limitation that the given points have to be the upper left and the lower right
corner, respectively. However, libgd already caters to upper right / lower left
pairs, and not catering to the other two combinations seems to be an oversight.
2015-07-20 02:14:29 +02:00
Christoph M. Becker a31fe58d80 Fix #70102: imagecreatefromwebm() shifts colors
libgd internally uses ARGB format, so we have to decode to ARGB instead of
RGBA.
2015-07-19 22:33:54 +02:00
Christoph M. Becker d3958b32ca fixed Fix #66590, which may segfault 2015-07-19 21:54:55 +02:00
Christoph M. Becker 96e42403d5 Fix #66590: imagewebp() doesn't pad to even length
The code in the bundled libgd uses libvpx and writes the riff manually. The
code generates the correct even size, but neglects the padding. It's possible
older versions of libwebp would decode this, but libwebp 0.4.0 does not.

Let's apply the patch supplied by one of the WebP developers.
2015-07-19 17:38:04 +02:00
Christoph M. Becker 00ba7e6215 Replaced libvpx by libwebp (first draft; Windows only)
ext/gd/libgd/gd_webp.c has been taken from libgd[1]. Mainly, gd_error(X) has
been subsituted by zend_error(E_ERROR, X) and BGD_DECLARE(X) by X. Further
modifications are obvious from the diff.

All GD tests are passing, what raises hope, but we need more WebP tests,
anyway.

[1] <https://github.com/libgd/libgd/blob/7ec030c4f1dae75ed5d82c3eed2abe6775742c75/src/gd_webp.c>
2015-07-21 10:37:06 +02:00
Christoph M. Becker 16d6a93f09 Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  revised bug53156.phpt
  Fix #53156: imagerectangle problem with point ordering
2015-07-21 01:20:02 +02:00
Christoph M. Becker ea37ca7707 Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  Fix #66387: Stack overflow with imagefilltoborder
2015-07-20 23:44:04 +02:00
Christoph M. Becker 6c8dbfd5c1 Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  Fix #70102: imagecreatefromwebm() shifts colors
2015-07-19 22:40:49 +02:00
Christoph M. Becker 209223b97e Merge branch 'PHP-5.6'
* PHP-5.6:
  fixed Fix #66590, which may segfault
2015-07-19 22:01:20 +02:00
Christoph M. Becker f9d95a4003 Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  Fix #66590: imagewebp() doesn't pad to even length
2015-07-19 17:45:16 +02:00
Christoph M. Becker 20eaa186fb Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  Fix #66882: imagerotate by -90 degrees truncates image by 1px
2015-07-13 22:30:43 +02:00
Christoph M. Becker 2e34febb73 Fix #66882: imagerotate by -90 degrees truncates image by 1px
Contrary to the external libgd, the bundled libgd doesn't use optimized
rotation algorithms for negative square angles. We fix that now.

There are other improvements in gdImageRotateInterpolated() in the external
libgd. I'll leave them out for now, in the hope that we'll be able to rejoin
the two libraries rather soon.
2015-07-13 22:18:56 +02:00
Christoph M. Becker fabc1b7174 Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  Fix #70064: imagescale(..., IMG_BICUBIC) leaks memory
2015-07-13 18:36:15 +02:00
Christoph M. Becker 1a4722a89e Fix #70064: imagescale(..., IMG_BICUBIC) leaks memory
A temporary image (tmp_im) is created with gdImageTrueColor() and freed with
gdFree() instead of gdImageDestroy(). Let's fix that.
2015-07-13 18:30:33 +02:00
Christoph M. Becker 959b2c3514 Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  Fix #69024: imagescale segfault with palette based image
2015-07-13 15:56:39 +02:00
Christoph M. Becker fa53d8463f Fix #69024: imagescale segfault with palette based image
imagescale(..., IMG_BICUBIC) is not supposed to work with palette images, so we
fix that by converting to true color if necessary. Basically the same fix has
already been applied to the external libgd[1].

[1] <https://github.com/libgd/libgd/commit/723ea520bed3b5854df87393c687323d3930edf3>
2015-07-13 15:48:48 +02:00
Christoph M. Becker 42d1fa29c7 Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  Fix #53154: Zero-height rectangle has whiskers
2015-07-13 01:46:09 +02:00
Christoph M. Becker 094decc3c0 Fix #53154: Zero-height rectangle has whiskers
To avoid drawing the corner pixels twice, gdImageRectangle() draws the vertical
lines 2 points shorter than the actual side of the rectangle. However, this
causes "whiskers" for rectangles with height 0. This patch fixes this issue and
at the same time optimizes the algorithm by drawing only a single line for zero
height and zero width rectangles.
2015-07-13 01:33:00 +02:00
Christoph M. Becker 930a9910d7 Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  Fix #67447: imagecrop() adds a black line when cropping
2015-07-12 23:15:06 +02:00
Christoph M. Becker 891ff131ef Fix #67447: imagecrop() adds a black line when cropping
A simple one-off error: imagecrop)() copied only width-1 and height-1 pixels.
2015-07-12 23:05:53 +02:00
Christoph M. Becker ce7b5af03f Merge branch 'PHP-5.6'
* PHP-5.6:
  updated NEWS
  Fix #68714: copy 'n paste error
2015-07-12 16:39:50 +02:00
Christoph M. Becker ba7c3a1bb4 Fix #68714: copy 'n paste error
Actually, this is not really a bug fix, but rather a simplification and
optimization in the same vein as has been done with the external libgd, but
going a small step further and joining both for loops.
2015-07-12 16:32:38 +02:00
Xinchen Hui 6de750efb7 Fixed conditional jump or move depends on uninitialised value(s)
==11551==    at 0x57CB23C: xpmParseData (parse.c:702)
2015-07-02 19:02:49 +08:00
Remi Collet fc8143f58a Merge branch 'PHP-5.6'
* PHP-5.6:
  NEWS
  NEWS
  Fixed Bug #69479 GD fails to build with newer libvpx
2015-05-24 09:40:08 +02:00
Remi Collet 565de1ae64 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  NEWS
  Fixed Bug #69479 GD fails to build with newer libvpx
2015-05-24 09:39:20 +02:00
Remi Collet e807e07bfa Fixed Bug #69479 GD fails to build with newer libvpx
From upstream https://github.com/libgd/libgd/commit/d41eb72cd4545c394578332e5c102dee69e02ee8

Fix build with latest libvpx 1.4.0

These new constants exist at least since 1.0.0
Compatibility ones have been droped in 1.4.0
2015-05-24 09:37:12 +02:00
Stanislav Malyshev 736afd48cf Merge branch 'PHP-5.6'
* PHP-5.6:
  Reduce downstream patches
2015-03-22 21:33:52 -07:00
lesniewskister c12e031530 Reduce downstream patches
As per http://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/lang/php/5.6/patches/patch-ext_gd_libgd_gdcache_h?rev=1.1&content-type=text/x-cvsweb-markup
2015-03-22 21:33:45 -07:00
Xinchen Hui fc33f52d8c bump year 2015-01-15 23:27:30 +08:00
Xinchen Hui 0579e8278d bump year 2015-01-15 23:26:37 +08:00
Xinchen Hui 73c1be2653 Bump year 2015-01-15 23:26:03 +08:00
Stanislav Malyshev b7a7b1a624 trailing whitespace removal 2015-01-10 15:07:38 -08:00
Stanislav Malyshev 95183cc339 Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
  fix memory leak
2015-01-04 21:08:16 -08:00
Stanislav Malyshev 184b6d9e73 fix memory leak 2015-01-04 21:07:57 -08:00
Remi Collet df4aaa81ef Fix Bug #68713 infinite loop / infinite free
PHP not affected (emalloc never return NULL)
Just to reduce diff with upstream and for legibility

Apply:
https://bitbucket.org/libgd/gd-libgd/commits/3c0d2203b2672b688d4d2326ff3a60b019879062
https://bitbucket.org/libgd/gd-libgd/commits/4af76c97a478d4e7c4b64e08ac67abbca7cbd0fb
2015-01-03 08:34:27 +01:00
Anatol Belski 9c354ba182 Merge remote-tracking branch 'origin/master' into native-tls
* origin/master:
  Better fix for #68601 for perf https://bitbucket.org/libgd/gd-libgd/commits/81e9a993f2893d651d225646378e3fd1b7465467
  Added EXPECTED(). Most functions have arguments.
2014-12-17 11:53:45 +01:00
Remi Collet f61071205f Merge branch 'PHP-5.6'
* PHP-5.6:
  Better fix for #68601 for perf https://bitbucket.org/libgd/gd-libgd/commits/81e9a993f2893d651d225646378e3fd1b7465467
2014-12-17 11:01:23 +01:00