summaryrefslogtreecommitdiff
path: root/ext/gd/libgd
diff options
context:
space:
mode:
Diffstat (limited to 'ext/gd/libgd')
-rw-r--r--ext/gd/libgd/gd.c4
-rw-r--r--ext/gd/libgd/gd.h2
-rw-r--r--ext/gd/libgd/gd_arc_f_buggy.c2
-rw-r--r--ext/gd/libgd/gd_gif_in.c15
-rw-r--r--ext/gd/libgd/gdft.c8
-rw-r--r--ext/gd/libgd/webpimg.c4
-rw-r--r--ext/gd/libgd/webpimg.h2
-rw-r--r--ext/gd/libgd/xbm.c2
8 files changed, 24 insertions, 15 deletions
diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index 54890bc17..d73f0943a 100644
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -3051,8 +3051,8 @@ int gdImagePaletteToTrueColor(gdImagePtr src)
}
}
- /* free old palette buffer */
- for (yy = y - 1; yy >= yy - 1; yy--) {
+ /* free old palette buffer (y is sy) */
+ for (yy = 0; yy < y; yy++) {
gdFree(src->pixels[yy]);
}
gdFree(src->pixels);
diff --git a/ext/gd/libgd/gd.h b/ext/gd/libgd/gd.h
index b61d972e8..0ace31ba0 100644
--- a/ext/gd/libgd/gd.h
+++ b/ext/gd/libgd/gd.h
@@ -782,7 +782,7 @@ int gdImageBrightness(gdImagePtr src, int brightness);
/* Set the contrast level <contrast> for the image <src> */
int gdImageContrast(gdImagePtr src, double contrast);
-/* Simply adds or substracts respectively red, green or blue to a pixel */
+/* Simply adds or subtracts respectively red, green or blue to a pixel */
int gdImageColor(gdImagePtr src, const int red, const int green, const int blue, const int alpha);
/* Image convolution by a 3x3 custom matrix */
diff --git a/ext/gd/libgd/gd_arc_f_buggy.c b/ext/gd/libgd/gd_arc_f_buggy.c
index c26e42171..ffab55123 100644
--- a/ext/gd/libgd/gd_arc_f_buggy.c
+++ b/ext/gd/libgd/gd_arc_f_buggy.c
@@ -1,6 +1,6 @@
/* This is potentially great stuff, but fails against the test
program at the end. This would probably be much more
- efficent than the implementation currently in gd.c if the
+ efficient than the implementation currently in gd.c if the
errors in the output were corrected. TBB */
#if 0
diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
index ee88a2fc8..f41ec8460 100644
--- a/ext/gd/libgd/gd_gif_in.c
+++ b/ext/gd/libgd/gd_gif_in.c
@@ -72,8 +72,10 @@ static struct {
#define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2)
+#define CSD_BUF_SIZE 280
+
typedef struct {
- unsigned char buf[280];
+ unsigned char buf[CSD_BUF_SIZE];
int curbit, lastbit, done, last_byte;
} CODE_STATIC_DATA;
@@ -398,9 +400,14 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
scd->lastbit = (2+count)*8 ;
}
- ret = 0;
- for (i = scd->curbit, j = 0; j < code_size; ++i, ++j)
- ret |= ((scd->buf[ i / 8 ] & (1 << (i % 8))) != 0) << j;
+ if ((scd->curbit + code_size - 1) >= (CSD_BUF_SIZE * 8)) {
+ ret = -1;
+ } else {
+ ret = 0;
+ for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) {
+ ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
+ }
+ }
scd->curbit += code_size;
return ret;
diff --git a/ext/gd/libgd/gdft.c b/ext/gd/libgd/gdft.c
index f4ee63908..ba905dc0a 100644
--- a/ext/gd/libgd/gdft.c
+++ b/ext/gd/libgd/gdft.c
@@ -390,9 +390,10 @@ static void *fontFetch (char **error, void *key)
fontlist = gdEstrdup(a->fontlist);
/*
- * Must use gd_strtok_r else pointer corrupted by strtok in nested loop.
+ * Must use gd_strtok_r becasuse strtok() isn't thread safe
*/
for (name = gd_strtok_r (fontlist, LISTSEPARATOR, &strtok_ptr); name; name = gd_strtok_r (0, LISTSEPARATOR, &strtok_ptr)) {
+ char *strtok_ptr_path;
/* make a fresh copy each time - strtok corrupts it. */
path = gdEstrdup (fontsearchpath);
@@ -408,7 +409,8 @@ static void *fontFetch (char **error, void *key)
break;
}
}
- for (dir = strtok (path, PATHSEPARATOR); dir; dir = strtok (0, PATHSEPARATOR)) {
+ for (dir = gd_strtok_r (path, PATHSEPARATOR, &strtok_ptr_path); dir;
+ dir = gd_strtok_r (0, PATHSEPARATOR, &strtok_ptr_path)) {
if (!strcmp(dir, ".")) {
TSRMLS_FETCH();
#if HAVE_GETCWD
@@ -462,7 +464,7 @@ static void *fontFetch (char **error, void *key)
return NULL;
}
- /* FIXME - This mapping stuff is imcomplete - where is the spec? */
+ /* FIXME - This mapping stuff is incomplete - where is the spec? */
/* EAM - It's worse than that. It's pointless to match character encodings here.
* As currently written, the stored a->face->charmap only matches one of
* the actual charmaps and we cannot know at this stage if it is the right
diff --git a/ext/gd/libgd/webpimg.c b/ext/gd/libgd/webpimg.c
index 01bef93c4..95a8081e0 100644
--- a/ext/gd/libgd/webpimg.c
+++ b/ext/gd/libgd/webpimg.c
@@ -169,7 +169,7 @@ static inline uint32 get_le32(const uint8* const data) {
* Y2/U2/V2: The Y/U/V data of the second image
*
* Returns the PSNR (http://en.wikipedia.org/wiki/Peak_signal-to-noise_ratio)
- * value computed bewteen the two images
+ * value computed between the two images
*/
double GetPSNRYuv(const uint8* Y1,
const uint8* U1,
@@ -210,7 +210,7 @@ double GetPSNRYuv(const uint8* Y1,
* imgdata: data buffer containing webp image
* imgdata_size: size of the imgdata buffer
*
- * Returns the PSNR value computed bewteen the two images
+ * Returns the PSNR value computed between the two images
*/
double WebPGetPSNR(const uint8* Y1,
const uint8* U1,
diff --git a/ext/gd/libgd/webpimg.h b/ext/gd/libgd/webpimg.h
index db23de5bb..bc0f9722b 100644
--- a/ext/gd/libgd/webpimg.h
+++ b/ext/gd/libgd/webpimg.h
@@ -57,7 +57,7 @@ typedef enum WebPResultType {
* 3. p_Y/p_U/p_V : pointer to the Y/U/V data buffer (this routine will
* allocate memory for the buffer, fill the buffer with
* appropriate data and transfer owner ship of the buffer
- * to caller. Caller is reponsible for freeing the memory).
+ * to caller. Caller is responsible for freeing the memory).
* Note that the memory for Y, U, V buffers is alloacted
* in one chunk, hence one should call free(*p_Y) only.
* Do not try to free the U and V buffers.
diff --git a/ext/gd/libgd/xbm.c b/ext/gd/libgd/xbm.c
index d6fdd7d08..50a4d225e 100644
--- a/ext/gd/libgd/xbm.c
+++ b/ext/gd/libgd/xbm.c
@@ -2,7 +2,7 @@
+----------------------------------------------------------------------+
| PHP Version 5 |
+----------------------------------------------------------------------+
- | Copyright (c) 1997-2014 The PHP Group |
+ | Copyright (c) 1997-2015 The PHP Group |
+----------------------------------------------------------------------+
| This source file is subject to version 3.01 of the PHP license, |
| that is bundled with this package in the file LICENSE, and is |
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-27 06:26:38 +0000