delta/php-git.git/ext/gd, branch PHP-5.6.33

Fixed bug #75571: Potential infinite loop in gdImageCreateFromGifCtx

2018-01-02T03:51:26+00:00

Due to a signedness confusion in `GetCode_` a corrupt GIF file can
trigger an infinite loop.  Furthermore we make sure that a GIF without
any palette entries is treated as invalid *after* open palette entries
have been removed.

Fix #74435: Buffer over-read into uninitialized memory

2017-07-05T02:00:57+00:00

The stack allocated color map buffers were not zeroed before usage, and
so undefined palette indexes could cause information leakage.

Fix #73869: Signed Integer Overflow gd_io.c

2017-01-17T08:30:58+00:00

GD2 stores the number of horizontal and vertical chunks as words (i.e. 2
byte unsigned). These values are multiplied and assigned to an int when
reading the image, what can cause integer overflows. We have to avoid
that, and also make sure that either chunk count is actually greater
than zero. If illegal chunk counts are detected, we bail out from
reading the image.

(cherry picked from commit 5b5d9db3988b829e0b121b74bb3947f01c2796a1)

Fix #73868: DOS vulnerability in gdImageCreateFromGd2Ctx()

2017-01-17T08:30:43+00:00

We must not pretend that there are image data if there are none. Instead
we fail reading the image file gracefully.

(cherry picked from commit cdb648dc4115ce0722f3cc75e6a65115fc0e56ab)

Fix #73549: Use after free when stream is passed to imagepng

2016-11-27T22:51:02+00:00

If a stream is passed to imagepng() or other image output functions,
opposed to a filename, we must not close this stream.

Fix #73582: Failing ext/gd/tests/imagettftext_charmap_order.phpt

2016-11-25T22:14:08+00:00

This test is not supposed to work with JIS-mapped Japanese font support
enabled.

Merge remote-tracking branch 'phpsec/PHP-5.6.28' into PHP-5.6

2016-11-08T10:06:52+00:00

Fix #72696: imagefilltoborder stackoverflow on truecolor images

2016-10-30T21:31:29+00:00

We must not allow negative color values be passed to
gdImageFillToBorder(), because that can lead to infinite recursion
since the recursion termination condition will not necessarily be met.

Fix #72482: Ilegal write/read access caused by gdImageAALine overflow

2016-10-30T21:28:23+00:00

Instead of rolling our own bounds check we use clip_1d() as it's done
in gdImageLine() and in external libgd. We must not pass the image
width and height, respectively, but rather the largest ordinate value
that is allowed to be accessed, i.e. width-1 and height-1,
respectively.

Fix #72494: imagecropauto out-of-bounds access

2016-10-25T12:29:48+00:00

This issue has actually already been fixed with commit 46f2c690. We're
adding a regression test and a NEWS entry, and also port the fix in
gdImageCropThreshold() from libgd:
  * 
  *