fix the fix for bug #70976 (imagerotate)

remicollet · Julien Pauli · commit aa8d3a8cc612 · 2016-01-12T14:03:35.000+01:00
diff --git a/ext/gd/libgd/gd_interpolation.c b/ext/gd/libgd/gd_interpolation.c
@@ -2154,15 +2154,15 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in
 {
 	const int angle_rounded = (int)floor(angle * 100);
 
-	if (bgcolor < 0 || (!src->trueColor && bgcolor >= gdMaxColors)) {
+	if (bgcolor < 0) {
 		return NULL;
 	}
 
 	/* impact perf a bit, but not that much. Implementation for palette
 	   images can be done at a later point.
 	*/
 	if (src->trueColor == 0) {
-		if (bgcolor >= 0) {
+		if (bgcolor < gdMaxColors) {
 			bgcolor =  gdTrueColorAlpha(src->red[bgcolor], src->green[bgcolor], src->blue[bgcolor], src->alpha[bgcolor]);
 		}
 		gdImagePaletteToTrueColor(src);
diff --git a/ext/gd/tests/bug70976.phpt b/ext/gd/tests/bug70976.phpt
@@ -6,8 +6,8 @@ Bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds)
 ?>
 --FILE--
 <?php
-$img = imagerotate(imagecreate(1,1),45,0x7ffffff9);
+$img = imagerotate(imagecreate(10,10),45,0x7ffffff9);
 var_dump($img);
 ?>
 --EXPECTF--
-bool(false)
+resource(5) of type (gd)

Original file line number	Diff line number	Diff line change
`@@ -2154,15 +2154,15 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in`
`2154`	`2154`	`{`
`2155`	`2155`	`const int angle_rounded = (int)floor(angle * 100);`
`2156`	`2156`
`2157`		`- if (bgcolor < 0 \|\| (!src->trueColor && bgcolor >= gdMaxColors)) {`
	`2157`	`+ if (bgcolor < 0) {`
`2158`	`2158`	`return NULL;`
`2159`	`2159`	`}`
`2160`	`2160`
`2161`	`2161`	`/* impact perf a bit, but not that much. Implementation for palette`
`2162`	`2162`	`images can be done at a later point.`
`2163`	`2163`	`*/`
`2164`	`2164`	`if (src->trueColor == 0) {`
`2165`		`- if (bgcolor >= 0) {`
	`2165`	`+ if (bgcolor < gdMaxColors) {`
`2166`	`2166`	`bgcolor = gdTrueColorAlpha(src->red[bgcolor], src->green[bgcolor], src->blue[bgcolor], src->alpha[bgcolor]);`
`2167`	`2167`	`}`
`2168`	`2168`	`gdImagePaletteToTrueColor(src);`