[PHP-CVS] cvs: php-src /ext/gd/libgd gd.c /ext/gd/tests bug43121.gif bug43121.phpt

[Mattias Bengtsson]

mattias         Sun Nov  4 23:57:07 2007 UTC

  Modified files:              
    /php-src/ext/gd/libgd       gd.c 
    /php-src/ext/gd/tests       bug43121.gif bug43121.phpt 
  Log:
  -MFB, Fixed Bug #43121 (gdImageFill with IMG_COLOR_TILED crashes httpd)
  
http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gd.c?r1=1.113&r2=1.114&diff_format=u
Index: php-src/ext/gd/libgd/gd.c
diff -u php-src/ext/gd/libgd/gd.c:1.113 php-src/ext/gd/libgd/gd.c:1.114
--- php-src/ext/gd/libgd/gd.c:1.113     Tue Sep 11 21:07:04 2007
+++ php-src/ext/gd/libgd/gd.c   Sun Nov  4 23:57:07 2007
@@ -2047,14 +2047,14 @@
 
 static void _gdImageFillTiled(gdImagePtr im, int x, int y, int nc)
 {
-       int l, x1, x2, dy;
+       int i, l, x1, x2, dy;
        int oc;   /* old pixel value */
        int tiled;
        int wx2,wy2;
        /* stack of filled segments */
        struct seg *stack;
        struct seg *sp;
-       char *pts;
+       char **pts;
 
        if (!im->tile) {
                return;
@@ -2064,7 +2064,11 @@
        tiled = nc==gdTiled;
 
        nc =  gdImageTileGet(im,x,y);
-       pts = (char *) ecalloc(im->sy * im->sx, sizeof(char));
+
+       pts = (char **) ecalloc(im->sy + 1, sizeof(char *));
+       for (i = 0; i < im->sy + 1; i++) {
+               pts[i] = (char *) ecalloc(im->sx + 1, sizeof(char));
+       }
 
        stack = (struct seg *)safe_emalloc(sizeof(struct seg), 
((int)(im->sy*im->sx)/4), 1);
        sp = stack;
@@ -2077,9 +2081,9 @@
        FILL_PUSH(y+1, x, x, -1);
        while (sp>stack) {
                FILL_POP(y, x1, x2, dy);
-               for (x=x1; x>=0 && (!pts[y + x*wx2] && 
gdImageGetPixel(im,x,y)==oc); x--) {
+               for (x=x1; x>=0 && (!pts[y][x] && gdImageGetPixel(im,x,y)==oc); 
x--) {
                        nc = gdImageTileGet(im,x,y);
-                       pts[y + x*wx2]=1;
+                       pts[y][x] = 1;
                        gdImageSetPixel(im,x, y, nc);
                }
                if (x>=x1) {
@@ -2093,9 +2097,9 @@
                }
                x = x1+1;
                do {
-                       for (; x<wx2 && (!pts[y + x*wx2] && 
gdImageGetPixel(im,x, y)==oc) ; x++) {
+                       for(; x<wx2 && (!pts[y][x] && gdImageGetPixel(im,x, 
y)==oc); x++) {
                                nc = gdImageTileGet(im,x,y);
-                               pts[y + x*wx2]=1;
+                               pts[y][x] = 1;
                                gdImageSetPixel(im, x, y, nc);
                        }
                        FILL_PUSH(y, l, x-1, dy);
@@ -2103,11 +2107,15 @@
                        if (x>x2+1) {
                                FILL_PUSH(y, x2+1, x-1, -dy);
                        }
-skip:                  for (x++; x<=x2 && (pts[y + x*wx2] || 
gdImageGetPixel(im,x, y)!=oc); x++);
+skip:          for(x++; x<=x2 && (pts[y][x] || gdImageGetPixel(im,x, y)!=oc); 
x++);
                        l = x;
                } while (x<=x2);
        }
 
+       for(i = 0; i < im->sy + 1; i++) {
+               efree(pts[i]);
+       }
+
        efree(pts);
        efree(stack);
 }
http://cvs.php.net/viewvc.cgi/php-src/ext/gd/tests/bug43121.gif?r1=1.1&r2=1.2&diff_format=u
Index: php-src/ext/gd/tests/bug43121.gif
http://cvs.php.net/viewvc.cgi/php-src/ext/gd/tests/bug43121.phpt?r1=1.1&r2=1.2&diff_format=u
Index: php-src/ext/gd/tests/bug43121.phpt
diff -u /dev/null php-src/ext/gd/tests/bug43121.phpt:1.2
--- /dev/null   Sun Nov  4 23:57:07 2007
+++ php-src/ext/gd/tests/bug43121.phpt  Sun Nov  4 23:57:07 2007
@@ -0,0 +1,21 @@
+--TEST--
+Bug #43121 (gdImageFill with IMG_COLOR_TILED crashes httpd)
+--SKIPIF--
+<?php
+       if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$im = ImageCreate( 200, 100 );
+$black = ImageColorAllocate( $im, 0, 0, 0 );
+
+$im_tile = ImageCreateFromGif( "transback.gif" );
+ImageSetTile( $im, $im_tile );
+ImageFill( $im, 0, 0, IMG_COLOR_TILED );
+
+ImageDestroy( $im );
+
+print "OK";
+?>
+--EXPECTF--
+OK

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php