Patch libgd-test.patch for GD related Bug #66815

Patch version 2014-03-03 16:13 UTC

Obsoleted by patches:

• 0001-Fix-NULL-deref-in-gdImageCrop.patch, revision 2014-03-03 16:19 UTC

Obsolete patches:

• tests.patch, revision 2014-03-03 16:10 UTC

• 2014-03-03 16:13 UTC [diff to current]

Developer: remi@php.net

diff -up ext/gd/libgd/gd_crop.c.orig ext/gd/libgd/gd_crop.c
--- ext/gd/libgd/gd_crop.c.orig	2014-03-03 15:50:53.478394740 +0100
+++ ext/gd/libgd/gd_crop.c	2014-03-03 16:45:54.584277726 +0100
@@ -45,22 +45,20 @@ gdImagePtr gdImageCrop(gdImagePtr src, c
 	gdImagePtr dst;
 	int y;
 
-	/* check size */
-	if (crop->width<=0 || crop->height<=0) {
-		return NULL;
-	}
-
 	/* allocate the requested size (could be only partially filled) */
 	if (src->trueColor) {
 		dst = gdImageCreateTrueColor(crop->width, crop->height);
+		if (dst == NULL) {
+			return NULL;
+		}
 		gdImageSaveAlpha(dst, 1);
 	} else {
 		dst = gdImageCreate(crop->width, crop->height);
+		if (dst == NULL) {
+			return NULL;
+		}
 		gdImagePaletteCopy(dst, src);
 	}
-	if (dst == NULL) {
-		return NULL;
-	}
 	dst->transparent = src->transparent;
 
 	/* check position in the src image */
diff -up ext/gd/tests/bug66356.phpt.orig ext/gd/tests/bug66356.phpt
--- ext/gd/tests/bug66356.phpt.orig	2014-03-03 16:55:47.826375795 +0100
+++ ext/gd/tests/bug66356.phpt	2014-03-03 16:55:57.130408433 +0100
@@ -24,6 +24,8 @@ var_dump(imagecrop($img, array("x" => -2
 // POC #4
 var_dump(imagecrop($img, array("x" => 0x7fffff00, "y" => 0, "width" => 10, "height" => 10)));
 
+// bug 66815
+var_dump(imagecrop($img, array("x" => 0, "y" => 0, "width" => 65535, "height" => 65535)));
 ?>
 --EXPECTF--
 resource(%d) of type (gd)
@@ -35,6 +37,13 @@ Array
     [width] => 10
     [height] => 10
 )
+
+Warning: imagecrop(): gd warning: one parameter to a memory allocation multiplication is negative or zero, failing operation gracefully
+ in %sbug66356.php on line %d
 bool(false)
 resource(%d) of type (gd)
-resource(%d) of type (gd)
\ Pas de fin de ligne à la fin du fichier
+resource(%d) of type (gd)
+
+Warning: imagecrop(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
+ in %sbug66356.php on line %d
+bool(false)
\ Pas de fin de ligne à la fin du fichier