From 22b274864edbc4052b961c5d14beecf665b46c49 Mon Sep 17 00:00:00 2001
From: Remi Collet <fedora@famillecollet.com>
Date: Sat, 10 Sep 2016 10:14:22 +0200
Subject: PHP 5.5.38 + security patches from 5.6.25

---
 bug72730.patch | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 bug72730.patch

(limited to 'bug72730.patch')

diff --git a/bug72730.patch b/bug72730.patch
new file mode 100644
index 0000000..a23f63d
--- /dev/null
+++ b/bug72730.patch
@@ -0,0 +1,52 @@
+Backported from 5.6.25 by Remi.
+
+From 229782c0ada4d7e72dba6327cc7dff889ce7d92f Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Wed, 10 Aug 2016 00:14:58 -0700
+Subject: [PATCH] Fix bug #72730 - imagegammacorrect allows arbitrary write
+ access
+
+---
+ ext/gd/gd.c                |  5 +++++
+ ext/gd/tests/bug72730.phpt | 15 +++++++++++++++
+ 2 files changed, 20 insertions(+)
+ create mode 100644 ext/gd/tests/bug72730.phpt
+
+diff --git a/ext/gd/gd.c b/ext/gd/gd.c
+index 5c604b7..0fb9604 100644
+--- a/ext/gd/gd.c
++++ b/ext/gd/gd.c
+@@ -3036,6 +3036,11 @@ PHP_FUNCTION(imagegammacorrect)
+ 		return;
+ 	}
+ 
++	if ( input <= 0.0 || output <= 0.0 ) {
++		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive");
++		RETURN_FALSE;
++	}
++
+ 	ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);
+ 
+ 	if (gdImageTrueColor(im))	{
+diff --git a/ext/gd/tests/bug72730.phpt b/ext/gd/tests/bug72730.phpt
+new file mode 100644
+index 0000000..e7c13cb
+--- /dev/null
++++ b/ext/gd/tests/bug72730.phpt
+@@ -0,0 +1,15 @@
++--TEST--
++Bug #72730: imagegammacorrect allows arbitrary write access
++--SKIPIF--
++<?php 
++if (!function_exists("imagecreatetruecolor")) die("skip");
++?>
++--FILE--
++<?php
++$img =  imagecreatetruecolor(1, 1);
++imagegammacorrect($img, -1, 1337);
++?>
++DONE
++--EXPECTF--
++Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d
++DONE
+\ No newline at end of file
-- 
cgit