tabe Thu, 14 Jan 2010 11:11:56 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=293538
Log:
imagepolygon() and imagefilledpolygon() does not allow negative number of
points causing invalid allocation
Changed paths:
U php/php-src/branches/PHP_5_2/ext/gd/gd.c
U php/php-src/branches/PHP_5_2/ext/gd/libgd/gd.c
A
php/php-src/branches/PHP_5_2/ext/gd/tests/imagefilledpolygon_negative.phpt
A php/php-src/branches/PHP_5_2/ext/gd/tests/imagepolygon_negative.phpt
U php/php-src/branches/PHP_5_3/ext/gd/gd.c
U php/php-src/branches/PHP_5_3/ext/gd/libgd/gd.c
A
php/php-src/branches/PHP_5_3/ext/gd/tests/imagefilledpolygon_negative.phpt
A php/php-src/branches/PHP_5_3/ext/gd/tests/imagepolygon_negative.phpt
U php/php-src/trunk/ext/gd/gd.c
U php/php-src/trunk/ext/gd/libgd/gd.c
A php/php-src/trunk/ext/gd/tests/imagefilledpolygon_negative.phpt
A php/php-src/trunk/ext/gd/tests/imagepolygon_negative.phpt
Modified: php/php-src/branches/PHP_5_2/ext/gd/gd.c
===================================================================
--- php/php-src/branches/PHP_5_2/ext/gd/gd.c 2010-01-14 10:35:28 UTC (rev 293537)
+++ php/php-src/branches/PHP_5_2/ext/gd/gd.c 2010-01-14 11:11:56 UTC (rev 293538)
@@ -3749,7 +3749,10 @@
php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must have at least 3 points in your array");
RETURN_FALSE;
}
-
+ if (npoints <= 0) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must give a positive number of points");
+ RETURN_FALSE;
+ }
if (nelem < npoints * 2) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Trying to use %d points in array with only %d points", npoints, nelem/2);
RETURN_FALSE;
Modified: php/php-src/branches/PHP_5_2/ext/gd/libgd/gd.c
===================================================================
--- php/php-src/branches/PHP_5_2/ext/gd/libgd/gd.c 2010-01-14 10:35:28 UTC (rev 293537)
+++ php/php-src/branches/PHP_5_2/ext/gd/libgd/gd.c 2010-01-14 11:11:56 UTC (rev 293538)
@@ -3195,7 +3195,7 @@
typedef void (*image_line)(gdImagePtr im, int x1, int y1, int x2, int y2, int color);
image_line draw_line;
- if (!n) {
+ if (n <= 0) {
return;
}
@@ -3248,7 +3248,7 @@
int ints;
int fill_color;
- if (!n) {
+ if (n <= 0) {
return;
}
Added: php/php-src/branches/PHP_5_2/ext/gd/tests/imagefilledpolygon_negative.phpt
===================================================================
--- php/php-src/branches/PHP_5_2/ext/gd/tests/imagefilledpolygon_negative.phpt (rev 0)
+++ php/php-src/branches/PHP_5_2/ext/gd/tests/imagefilledpolygon_negative.phpt 2010-01-14 11:11:56 UTC (rev 293538)
@@ -0,0 +1,15 @@
+--TEST--
+imagefilledpolygon() with a negative num of points
+--SKIPIF--
+<?php
+ if (!function_exists('imagefilledpolygon')) die('skip imagefilledpolygon() not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(100, 100);
+$black = imagecolorallocate($im, 0, 0, 0);
+if (imagefilledpolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
+imagedestroy($im);
+?>
+--EXPECTF--
+Warning: imagefilledpolygon(): You must give a positive number of points in %s on line %d
Added: php/php-src/branches/PHP_5_2/ext/gd/tests/imagepolygon_negative.phpt
===================================================================
--- php/php-src/branches/PHP_5_2/ext/gd/tests/imagepolygon_negative.phpt (rev 0)
+++ php/php-src/branches/PHP_5_2/ext/gd/tests/imagepolygon_negative.phpt 2010-01-14 11:11:56 UTC (rev 293538)
@@ -0,0 +1,15 @@
+--TEST--
+imagepolygon() with a negative num of points
+--SKIPIF--
+<?php
+ if (!function_exists('imagepolygon')) die('skip imagepolygon() not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(100, 100);
+$black = imagecolorallocate($im, 0, 0, 0);
+if (imagepolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
+imagedestroy($im);
+?>
+--EXPECTF--
+Warning: imagepolygon(): You must give a positive number of points in %s on line %d
Modified: php/php-src/branches/PHP_5_3/ext/gd/gd.c
===================================================================
--- php/php-src/branches/PHP_5_3/ext/gd/gd.c 2010-01-14 10:35:28 UTC (rev 293537)
+++ php/php-src/branches/PHP_5_3/ext/gd/gd.c 2010-01-14 11:11:56 UTC (rev 293538)
@@ -3427,7 +3427,10 @@
php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must have at least 3 points in your array");
RETURN_FALSE;
}
-
+ if (npoints <= 0) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must give a positive number of points");
+ RETURN_FALSE;
+ }
if (nelem < npoints * 2) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Trying to use %d points in array with only %d points", npoints, nelem/2);
RETURN_FALSE;
Modified: php/php-src/branches/PHP_5_3/ext/gd/libgd/gd.c
===================================================================
--- php/php-src/branches/PHP_5_3/ext/gd/libgd/gd.c 2010-01-14 10:35:28 UTC (rev 293537)
+++ php/php-src/branches/PHP_5_3/ext/gd/libgd/gd.c 2010-01-14 11:11:56 UTC (rev 293538)
@@ -2568,7 +2568,7 @@
typedef void (*image_line)(gdImagePtr im, int x1, int y1, int x2, int y2, int color);
image_line draw_line;
- if (!n) {
+ if (n <= 0) {
return;
}
@@ -2621,7 +2621,7 @@
int ints;
int fill_color;
- if (!n) {
+ if (n <= 0) {
return;
}
Added: php/php-src/branches/PHP_5_3/ext/gd/tests/imagefilledpolygon_negative.phpt
===================================================================
--- php/php-src/branches/PHP_5_3/ext/gd/tests/imagefilledpolygon_negative.phpt (rev 0)
+++ php/php-src/branches/PHP_5_3/ext/gd/tests/imagefilledpolygon_negative.phpt 2010-01-14 11:11:56 UTC (rev 293538)
@@ -0,0 +1,15 @@
+--TEST--
+imagefilledpolygon() with a negative num of points
+--SKIPIF--
+<?php
+ if (!function_exists('imagefilledpolygon')) die('skip imagefilledpolygon() not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(100, 100);
+$black = imagecolorallocate($im, 0, 0, 0);
+if (imagefilledpolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
+imagedestroy($im);
+?>
+--EXPECTF--
+Warning: imagefilledpolygon(): You must give a positive number of points in %s on line %d
Added: php/php-src/branches/PHP_5_3/ext/gd/tests/imagepolygon_negative.phpt
===================================================================
--- php/php-src/branches/PHP_5_3/ext/gd/tests/imagepolygon_negative.phpt (rev 0)
+++ php/php-src/branches/PHP_5_3/ext/gd/tests/imagepolygon_negative.phpt 2010-01-14 11:11:56 UTC (rev 293538)
@@ -0,0 +1,15 @@
+--TEST--
+imagepolygon() with a negative num of points
+--SKIPIF--
+<?php
+ if (!function_exists('imagepolygon')) die('skip imagepolygon() not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(100, 100);
+$black = imagecolorallocate($im, 0, 0, 0);
+if (imagepolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
+imagedestroy($im);
+?>
+--EXPECTF--
+Warning: imagepolygon(): You must give a positive number of points in %s on line %d
Modified: php/php-src/trunk/ext/gd/gd.c
===================================================================
--- php/php-src/trunk/ext/gd/gd.c 2010-01-14 10:35:28 UTC (rev 293537)
+++ php/php-src/trunk/ext/gd/gd.c 2010-01-14 11:11:56 UTC (rev 293538)
@@ -3170,7 +3170,10 @@
php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must have at least 3 points in your array");
RETURN_FALSE;
}
-
+ if (npoints <= 0) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must give a positive number of points");
+ RETURN_FALSE;
+ }
if (nelem < npoints * 2) {
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Trying to use %d points in array with only %d points", npoints, nelem/2);
RETURN_FALSE;
Modified: php/php-src/trunk/ext/gd/libgd/gd.c
===================================================================
--- php/php-src/trunk/ext/gd/libgd/gd.c 2010-01-14 10:35:28 UTC (rev 293537)
+++ php/php-src/trunk/ext/gd/libgd/gd.c 2010-01-14 11:11:56 UTC (rev 293538)
@@ -2563,7 +2563,7 @@
typedef void (*image_line)(gdImagePtr im, int x1, int y1, int x2, int y2, int color);
image_line draw_line;
- if (!n) {
+ if (n <= 0) {
return;
}
@@ -2616,7 +2616,7 @@
int ints;
int fill_color;
- if (!n) {
+ if (n <= 0) {
return;
}
Added: php/php-src/trunk/ext/gd/tests/imagefilledpolygon_negative.phpt
===================================================================
--- php/php-src/trunk/ext/gd/tests/imagefilledpolygon_negative.phpt (rev 0)
+++ php/php-src/trunk/ext/gd/tests/imagefilledpolygon_negative.phpt 2010-01-14 11:11:56 UTC (rev 293538)
@@ -0,0 +1,15 @@
+--TEST--
+imagefilledpolygon() with a negative num of points
+--SKIPIF--
+<?php
+ if (!function_exists('imagefilledpolygon')) die('skip imagefilledpolygon() not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(100, 100);
+$black = imagecolorallocate($im, 0, 0, 0);
+if (imagefilledpolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
+imagedestroy($im);
+?>
+--EXPECTF--
+Warning: imagefilledpolygon(): You must give a positive number of points in %s on line %d
Added: php/php-src/trunk/ext/gd/tests/imagepolygon_negative.phpt
===================================================================
--- php/php-src/trunk/ext/gd/tests/imagepolygon_negative.phpt (rev 0)
+++ php/php-src/trunk/ext/gd/tests/imagepolygon_negative.phpt 2010-01-14 11:11:56 UTC (rev 293538)
@@ -0,0 +1,15 @@
+--TEST--
+imagepolygon() with a negative num of points
+--SKIPIF--
+<?php
+ if (!function_exists('imagepolygon')) die('skip imagepolygon() not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(100, 100);
+$black = imagecolorallocate($im, 0, 0, 0);
+if (imagepolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
+imagedestroy($im);
+?>
+--EXPECTF--
+Warning: imagepolygon(): You must give a positive number of points in %s on line %d
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
