5 files changed, 22 insertions, 10 deletions

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index e4e2e0f1a..0cc2e1d7d 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -1845,9 +1845,9 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 struct seg {int y, xl, xr, dy;};
 
 /* max depth of stack */
-#define FILL_MAX 1200000
+#define FILL_MAX ((int)(im->sy*im->sx)/4)
 #define FILL_PUSH(Y, XL, XR, DY) \
-    if (sp<stack+FILL_MAX*10 && Y+(DY)>=0 && Y+(DY)<wy2) \
+    if (sp<stack+FILL_MAX && Y+(DY)>=0 && Y+(DY)<wy2) \
     {sp->y = Y; sp->xl = XL; sp->xr = XR; sp->dy = DY; sp++;}
 
 #define FILL_POP(Y, XL, XR, DY) \
@@ -1889,8 +1889,8 @@ void gdImageFill(gdImagePtr im, int x, int y, int nc)
 	}
 
 	/* Do not use the 4 neighbors implementation with
-   * small images
-   */
+	 * small images
+	 */
 	if (im->sx < 4) {
 		int ix = x, iy = y, c;
 		do {
@@ -1907,7 +1907,7 @@ void gdImageFill(gdImagePtr im, int x, int y, int nc)
 				goto done;
 			}
 			gdImageSetPixel(im, ix, iy, nc);
-		} while(ix++ < (im->sx -1));
+		} while(iy++ < (im->sy -1));
 		goto done;
 	}
 
diff --git a/ext/gd/libgd/gd_gif_out.c b/ext/gd/libgd/gd_gif_out.c
index 1fe36880a..14045385a 100644
--- a/ext/gd/libgd/gd_gif_out.c
+++ b/ext/gd/libgd/gd_gif_out.c
@@ -117,9 +117,8 @@ void gdImageGif (gdImagePtr im, FILE * outFile)
 void gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
 {
 	gdImagePtr pim = 0, tim = im;
-	int interlace, transparent, BitsPerPixel;
+	int interlace, BitsPerPixel;
 	interlace = im->interlace;
-	transparent = im->transparent;
 	if (im->trueColor) {
 		/* Expensive, but the only way that produces an
 			acceptable result: mix down to a palette
diff --git a/ext/gd/libgd/gd_jpeg.c b/ext/gd/libgd/gd_jpeg.c
index 0d9bae151..175c5b85f 100644
--- a/ext/gd/libgd/gd_jpeg.c
+++ b/ext/gd/libgd/gd_jpeg.c
@@ -51,8 +51,8 @@ static long php_jpeg_emit_message(j_common_ptr jpeg_info, int level)
 	char message[JMSG_LENGTH_MAX];
 	jmpbuf_wrapper *jmpbufw;
 	int ignore_warning = 0;
-	
-    jmpbufw = (jmpbuf_wrapper *) jpeg_info->client_data;
+
+	jmpbufw = (jmpbuf_wrapper *) jpeg_info->client_data;
 
 	if (jmpbufw != 0) {
 		ignore_warning = jmpbufw->ignore_warning;
@@ -113,6 +113,15 @@ const char * gdJpegGetVersionString()
 		case 62:
 			return "6b";
 			break;
+
+		case 70:
+			return "7";
+			break;
+
+		case 80:
+			return "8";
+			break;
+
 		default:
 			return "unknown";
 	}
diff --git a/ext/gd/libgd/gd_png.c b/ext/gd/libgd/gd_png.c
index 52a087e78..49f7cb077 100644
--- a/ext/gd/libgd/gd_png.c
+++ b/ext/gd/libgd/gd_png.c
@@ -515,6 +515,10 @@ void gdImagePngCtxEx (gdImagePtr im, gdIOCtx * outfile, int level, int basefilte
 	/*  png_set_filter(png_ptr, 0, PNG_FILTER_NONE);  */
 
 	/* 2.0.12: this is finally a parameter */
+	if (level != -1 && (level < 0 || level > 9)) {
+		php_gd_error("gd-png error: compression level must be 0 through 9");
+		return;
+	}
 	png_set_compression_level(png_ptr, level);
 	if (basefilter >= 0) {
 		png_set_filter(png_ptr, PNG_FILTER_TYPE_BASE, basefilter);
diff --git a/ext/gd/libgd/gdft.c b/ext/gd/libgd/gdft.c
index a3ced0ab1..ac2bf344f 100644
--- a/ext/gd/libgd/gdft.c
+++ b/ext/gd/libgd/gdft.c
@@ -1101,7 +1101,7 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 
 			/* now, draw to our target surface */
 			bm = (FT_BitmapGlyph) image;
-			gdft_draw_bitmap(tc_cache, im, fg, bm->bitmap, x + x1 + ((pen.x + 31) >> 6), y + y1 + ((pen.y + 31) >> 6) - bm->top);
+			gdft_draw_bitmap(tc_cache, im, fg, bm->bitmap, x + x1 + ((pen.x + 31) >> 6) + bm->left, y + y1 + ((pen.y + 31) >> 6) - bm->top);
 		}
 
 		/* record current glyph index for kerning */