Skip to content

Instantly share code, notes, and snippets.

/72298.diff Secret
Created Jun 19, 2016

Embed
What would you like to do?
Patch for 72298
commit e9ac8954be9f7d988189df44578d759ffdea3512
Author: Stanislav Malyshev <stas@php.net>
Date: Sat Jun 18 21:04:33 2016 -0700
Fix bug #72298 pass2_no_dither out-of-bounds access
diff --git a/ext/gd/libgd/gd_topal.c b/ext/gd/libgd/gd_topal.c
index b9cb928..d8dda45 100644
--- a/ext/gd/libgd/gd_topal.c
+++ b/ext/gd/libgd/gd_topal.c
@@ -1329,7 +1329,7 @@ pass2_no_dither (j_decompress_ptr cinfo,
/* If the pixel is transparent, we assign it the palette index that
* will later be added at the end of the palette as the transparent
* index. */
- if ((oim->transparent >= 0) && (oim->transparent == *(inptr - 1)))
+ if ((oim->transparent >= 0) && (oim->transparent == *inptr))
{
*outptr++ = nim->colorsTotal;
inptr++;
diff --git a/ext/gd/tests/bug72298.phpt b/ext/gd/tests/bug72298.phpt
new file mode 100644
index 0000000..7fba241
--- /dev/null
+++ b/ext/gd/tests/bug72298.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #72298: pass2_no_dither out-of-bounds access
+--SKIPIF--
+<?php
+ if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
+--FILE--
+<?php
+$img = imagecreatetruecolor (1 , 1);
+imagecolortransparent($img, 0);
+imagetruecolortopalette($img, false, 4);
+?>
+DONE
+--EXPECT--
+DONE
\ No newline at end of file
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.