pajoye Sun Jul 16 11:07:31 2006 UTC
Modified files: (Branch: PHP_5_2)
/php-src/ext/gd/libgd gd_gif_in.c
Log:
- #38112, corrupt GIF segfaults, test will follow
http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd_gif_in.c?r1=1.5.4.2.2.4&r2=1.5.4.2.2.5&diff_format=u
Index: php-src/ext/gd/libgd/gd_gif_in.c
diff -u php-src/ext/gd/libgd/gd_gif_in.c:1.5.4.2.2.4
php-src/ext/gd/libgd/gd_gif_in.c:1.5.4.2.2.5
--- php-src/ext/gd/libgd/gd_gif_in.c:1.5.4.2.2.4 Mon May 8 12:06:59 2006
+++ php-src/ext/gd/libgd/gd_gif_in.c Sun Jul 16 11:07:31 2006
@@ -206,6 +206,7 @@
BitSet(buf[8], INTERLACE));
/*1.4//imageCount != imageNumber); */
}
+
if (Transparent != (-1)) {
gdImageColorTransparent(im, Transparent);
}
@@ -217,6 +218,12 @@
if (!im) {
return 0;
}
+
+ if (!im->colorsTotal) {
+ gdImageDestroy(im);
+ return 0;
+ }
+
/* Check for open colors at the end, so
we can reduce colorsTotal and ultimately
BitsPerPixel */
@@ -506,6 +513,19 @@
int v;
int xpos = 0, ypos = 0, pass = 0;
int i;
+
+
+ /*
+ ** Initialize the Compression routines
+ */
+ if (! ReadOK(fd,&c,1)) {
+ return;
+ }
+
+ if (c > 8) {
+ return;
+ }
+
/* Stash the color map into the image */
for (i=0; (i<gdMaxColors); i++) {
im->red[i] = cmap[CM_RED][i];
@@ -515,12 +535,6 @@
}
/* Many (perhaps most) of these colors will remain marked open. */
im->colorsTotal = gdMaxColors;
- /*
- ** Initialize the Compression routines
- */
- if (! ReadOK(fd,&c,1)) {
- return;
- }
if (LWZReadByte(fd, TRUE, c) < 0) {
return;
}
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
