This bug was first reported to php on https://bugs.php.net/bug.php?id=73968.
php then reported it to gd in https://github.com/libgd/libgd/issues/109.
Patch adapted from upstream source repository:
https://github.com/libgd/libgd/commit/082c5444838ea0d84f9fb6441aefdb44d78d9bba
Binary diffs have been removed from the patch because our patch
procedure doesn't support them.
From 082c5444838ea0d84f9fb6441aefdb44d78d9bba Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Fri, 20 Jan 2017 22:48:20 +0100
Subject: [PATCH] Fix #109: XBM reading fails with printed error
When calculating the number of required bytes of an XBM image, we have
to take the line padding into account.
---
src/gd_xbm.c | 2 +-
tests/xbm/CMakeLists.txt | 1 +
tests/xbm/Makemodule.am | 5 ++++-
tests/xbm/github_bug_109.c | 35 +++++++++++++++++++++++++++++++++++
tests/xbm/github_bug_109.xbm | 5 +++++
5 files changed, 47 insertions(+), 2 deletions(-)
create mode 100644 tests/xbm/github_bug_109.c
create mode 100644 tests/xbm/github_bug_109.xbm
create mode 100644 tests/xbm/github_bug_109_exp.png
diff --git a/src/gd_xbm.c b/src/gd_xbm.c
index 5f09b56..c2ba2ad 100644
--- a/src/gd_xbm.c
+++ b/src/gd_xbm.c
@@ -108,7 +108,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromXbm(FILE * fd)
max_bit = 32768;
}
if (max_bit) {
- bytes = (width * height / 8) + 1;
+ bytes = (width + 7) / 8 * height;
if (!bytes) {
return 0;
}
diff --git a/tests/xbm/CMakeLists.txt b/tests/xbm/CMakeLists.txt
index 183cf5e..08576e0 100644
--- a/tests/xbm/CMakeLists.txt
+++ b/tests/xbm/CMakeLists.txt
@@ -1,4 +1,5 @@
LIST(APPEND TESTS_FILES
+ github_bug_109
github_bug_170
)
diff --git a/tests/xbm/Makemodule.am b/tests/xbm/Makemodule.am
index ba1eabd..0f5beb6 100644
--- a/tests/xbm/Makemodule.am
+++ b/tests/xbm/Makemodule.am
@@ -1,5 +1,8 @@
libgd_test_programs += \
+ xbm/github_bug_109 \
xbm/github_bug_170
EXTRA_DIST += \
- xbm/CMakeLists.txt
+ xbm/CMakeLists.txt \
+ xbm/github_bug_109.xbm \
+ xbm/github_bug_109_exp.png
diff --git a/tests/xbm/github_bug_109.c b/tests/xbm/github_bug_109.c
new file mode 100644
index 0000000..1a020c6
--- /dev/null
+++ b/tests/xbm/github_bug_109.c
@@ -0,0 +1,35 @@
+/**
+ * Test reading of XBM images with a width that is not a multiple of 8
+ *
+ * We're reading such an XBM image, and check that we got what we've expected,
+ * instead of an error message.
+ *
+ * See also <https://github.com/libgd/libgd/issues/109>.
+ */
+
+
+#include "gd.h"
+#include "gdtest.h"
+
+
+int main()
+{
+ gdImagePtr im;
+ FILE *fp;
+ char *path;
+
+ fp = gdTestFileOpen2("xbm", "github_bug_109.xbm");
+ im = gdImageCreateFromXbm(fp);
+ fclose(fp);
+ gdTestAssert(im != NULL);
+ gdTestAssert(gdImageGetTrueColorPixel(im, 0, 0) == 0);
+ gdTestAssert(gdImageGetTrueColorPixel(im, 0, 1) == 0xffffff);
+
+ path = gdTestFilePath2("xbm", "github_bug_109_exp.png");
+ gdAssertImageEqualsToFile(path, im);
+ gdFree(path);
+
+ gdImageDestroy(im);
+
+ return gdNumFailures();
+}
diff --git a/tests/xbm/github_bug_109.xbm b/tests/xbm/github_bug_109.xbm
new file mode 100644
index 0000000..f427d86
--- /dev/null
+++ b/tests/xbm/github_bug_109.xbm
@@ -0,0 +1,5 @@
+#define test_width 10
+#define test_height 10
+static unsigned char test_bits[] = {
+ 0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00,
+ 0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00};
--
2.7.4