mattias Sun Nov 4 23:56:00 2007 UTC Added files: (Branch: PHP_5_2) /php-src/ext/gd/tests bug43121.gif bug43121.phpt
Modified files: /php-src/ext/gd/libgd gd.c Log: - Fixed Bug #43121 (gdImageFill with IMG_COLOR_TILED crashes httpd) http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd.c?r1=1.90.2.1.2.21&r2=1.90.2.1.2.22&diff_format=u Index: php-src/ext/gd/libgd/gd.c diff -u php-src/ext/gd/libgd/gd.c:1.90.2.1.2.21 php-src/ext/gd/libgd/gd.c:1.90.2.1.2.22 --- php-src/ext/gd/libgd/gd.c:1.90.2.1.2.21 Tue Sep 11 21:03:48 2007 +++ php-src/ext/gd/libgd/gd.c Sun Nov 4 23:56:00 2007 @@ -2050,14 +2050,14 @@ static void _gdImageFillTiled(gdImagePtr im, int x, int y, int nc) { - int l, x1, x2, dy; + int i, l, x1, x2, dy; int oc; /* old pixel value */ int tiled; int wx2,wy2; /* stack of filled segments */ struct seg *stack; struct seg *sp; - char *pts; + char **pts; if (!im->tile) { return; @@ -2067,7 +2067,11 @@ tiled = nc==gdTiled; nc = gdImageTileGet(im,x,y); - pts = (char *) ecalloc(im->sy * im->sx, sizeof(char)); + + pts = (char **) ecalloc(im->sy + 1, sizeof(char *)); + for (i = 0; i < im->sy + 1; i++) { + pts[i] = (char *) ecalloc(im->sx + 1, sizeof(char)); + } stack = (struct seg *)safe_emalloc(sizeof(struct seg), ((int)(im->sy*im->sx)/4), 1); sp = stack; @@ -2080,9 +2084,9 @@ FILL_PUSH(y+1, x, x, -1); while (sp>stack) { FILL_POP(y, x1, x2, dy); - for (x=x1; x>=0 && (!pts[y + x*wx2] && gdImageGetPixel(im,x,y)==oc); x--) { + for (x=x1; x>=0 && (!pts[y][x] && gdImageGetPixel(im,x,y)==oc); x--) { nc = gdImageTileGet(im,x,y); - pts[y + x*wx2]=1; + pts[y][x] = 1; gdImageSetPixel(im,x, y, nc); } if (x>=x1) { @@ -2096,9 +2100,9 @@ } x = x1+1; do { - for (; x<wx2 && (!pts[y + x*wx2] && gdImageGetPixel(im,x, y)==oc) ; x++) { + for(; x<wx2 && (!pts[y][x] && gdImageGetPixel(im,x, y)==oc); x++) { nc = gdImageTileGet(im,x,y); - pts[y + x*wx2]=1; + pts[y][x] = 1; gdImageSetPixel(im, x, y, nc); } FILL_PUSH(y, l, x-1, dy); @@ -2106,11 +2110,15 @@ if (x>x2+1) { FILL_PUSH(y, x2+1, x-1, -dy); } -skip: for (x++; x<=x2 && (pts[y + x*wx2] || gdImageGetPixel(im,x, y)!=oc); x++); +skip: for(x++; x<=x2 && (pts[y][x] || gdImageGetPixel(im,x, y)!=oc); x++); l = x; } while (x<=x2); } + for(i = 0; i < im->sy + 1; i++) { + efree(pts[i]); + } + efree(pts); efree(stack); } http://cvs.php.net/viewvc.cgi/php-src/ext/gd/tests/bug43121.phpt?view=markup&rev=1.1 Index: php-src/ext/gd/tests/bug43121.phpt +++ php-src/ext/gd/tests/bug43121.phpt -- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php