php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #28311 bug in gd_topal.c
Submitted: 2004-05-07 12:35 UTC Modified: 2004-05-28 15:47 UTC
From: pikeman at pikeman dot sytes dot net Assigned: pajoye
Status: Closed Package: GD related
PHP Version: 5.0.0RC2,4.3.7RC1 OS: redhat 9
Private report: No CVE-ID:
 [2004-05-07 12:35 UTC] pikeman at pikeman dot sytes dot net
Description:
------------
in gd_topal.c in function pass2_no_dither line 1321

transparency detection code, the pointer is off by one causing a nontransparent band in the transparent region in the resulting picture.

The inptr pointer has already been incremented to the next pixel at the transparency check. should be changed to (inptr-1) to check the correct pixel.

Reproduce code:
---------------
bad code:
	  r = gdTrueColorGetRed (*inptr);
	  g = gdTrueColorGetGreen (*inptr);
	  b = gdTrueColorGetBlue (*inptr++);

	  /* If the pixel is transparent, we assign it the palette index that
	   * will later be added at the end of the palette as the transparent
	   * index. */
	  if ((im->transparent >= 0) && (im->transparent == *inptr))
	    {
	      *outptr++ = im->colorsTotal;
	      continue;
	    }

Expected result:
----------------
*** gd_topal_original.c 2004-05-07 18:26:49.000000000 +0800
--- gd_topal.c  2004-05-07 17:30:29.000000000 +0800
***************
*** 1318,1324 ****
          /* If the pixel is transparent, we assign it the palette index that
           * will later be added at the end of the palette as the transparent
           * index. */
!         if ((im->transparent >= 0) && (im->transparent == *inptr))
            {
              *outptr++ = im->colorsTotal;
              continue;
--- 1318,1324 ----
          /* If the pixel is transparent, we assign it the palette index that
           * will later be added at the end of the palette as the transparent
           * index. */
!         if ((im->transparent >= 0) && (im->transparent == *(inptr-1)))
            {
              *outptr++ = im->colorsTotal;
              continue;

Actual result:
--------------
a bad picture.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-05-07 15:02 UTC] derick@php.net
Assigning to the maintainer
 [2004-05-09 19:47 UTC] iliaa@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 [2004-05-27 01:22 UTC] pikeman at pikeman dot sytes dot net
Hello, I noticed that it is fixed in 5.0 CVS but not in 4.3.x CVS, is it possible to fix it there also?
the same bug exists in both versions.
Would like to see it fixed for 4.3.7.
Additional info: GD 2.0.25 or above already have the same bug fixed. But I am not sure if 4.3.7 will integrate gd 2.0.25 in.
Thanks.
 [2004-05-28 15:47 UTC] iliaa@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Fri Apr 18 15:02:26 2014 UTC