delta/php-git.git/ext/gd/libgd/gd_gd2.c, branch PHP-5.6.33 git.php.net: repository/php-src.git Fix #73869: Signed Integer Overflow gd_io.c 2017-01-17T08:30:58+00:00 Christoph M. Becker cmbecker69@gmx.de 2016-12-17T16:06:58+00:00 d2274b01cbbadf5516b3ea87ad76fbae18834007 GD2 stores the number of horizontal and vertical chunks as words (i.e. 2 byte unsigned). These values are multiplied and assigned to an int when reading the image, what can cause integer overflows. We have to avoid that, and also make sure that either chunk count is actually greater than zero. If illegal chunk counts are detected, we bail out from reading the image. (cherry picked from commit 5b5d9db3988b829e0b121b74bb3947f01c2796a1) 
GD2 stores the number of horizontal and vertical chunks as words (i.e. 2
byte unsigned). These values are multiplied and assigned to an int when
reading the image, what can cause integer overflows. We have to avoid
that, and also make sure that either chunk count is actually greater
than zero. If illegal chunk counts are detected, we bail out from
reading the image.

(cherry picked from commit 5b5d9db3988b829e0b121b74bb3947f01c2796a1)
Fix #73868: DOS vulnerability in gdImageCreateFromGd2Ctx() 2017-01-17T08:30:43+00:00 Christoph M. Becker cmbecker69@gmx.de 2016-08-16T16:23:36+00:00 f1b2afc9d9e77edf41804f5dfc4e2069d8a12975 We must not pretend that there are image data if there are none. Instead we fail reading the image file gracefully. (cherry picked from commit cdb648dc4115ce0722f3cc75e6a65115fc0e56ab) 
We must not pretend that there are image data if there are none. Instead
we fail reading the image file gracefully.

(cherry picked from commit cdb648dc4115ce0722f3cc75e6a65115fc0e56ab)
Fix #73161: imagecreatefromgd2() may leak memory 2016-09-24T10:36:54+00:00 Christoph M. Becker cmbecker69@gmx.de 2016-09-24T10:36:54+00:00 8f5eda4bf62ca0e1ba6459b42fb5c0b629774cb2 






Fix #73159: imagegd2(): unrecognized formats may result in corrupted files
2016-09-24T09:28:20+00:00

Christoph M. Becker
cmbecker69@gmx.de

2016-09-24T09:28:20+00:00

709731797c55b373329201e9d3c9221303d7faa2

We must not apply the format correction twice for truecolor images.





We must not apply the format correction twice for truecolor images.







Fix #73155: imagegd2() writes wrong chunk sizes on boundaries
2016-09-24T08:33:49+00:00

Christoph M. Becker
cmbecker69@gmx.de

2016-09-23T22:46:35+00:00

c7936ead8fbe87a55e7c17f9449c2704acd810a3












fix tests
2016-06-21T05:54:55+00:00

Stanislav Malyshev
stas@php.net

2016-06-21T05:54:55+00:00

5f107ab8a66f8b36ac0c0b32e0231bf94e083c94












Fixed #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow
2016-06-18T18:15:10+00:00

Pierre Joye
pajoye@php.net

2016-06-18T18:15:10+00:00

7722455726bec8c53458a32851d2a87982cf0eac












Fix memory leak
2016-04-27T05:54:58+00:00

Stanislav Malyshev
stas@php.net

2016-04-27T05:54:58+00:00

61c7a06e7c19d9b408db1129efa0959a0acbf0b1












Fix for bug #71912 (libgd: signedness vulnerability)
2016-04-19T05:24:16+00:00

Stanislav Malyshev
stas@php.net

2016-04-19T05:20:22+00:00

b15f0ecc0f34364fd7ce924b4164be4e8198ff93












- MFB: silent compiler warnings
2006-11-04T14:29:00+00:00

Pierre Joye
pajoye@php.net

2006-11-04T14:29:00+00:00

c25d7f249a6656fc5e94cadb7f78356167daa7e6