We port the respective upstream fix[1]. We only run the test against
bundled libgd, since external libgd may yield different results.
Cf. <2b26be874d>.
Closes GH-17380.
Because the subpattern names are persistent, and the fact that the
symbol table destruction is skipped when using fast_shutdown,
this means the refcounts will not be updated for the destruction of
the arrays that hold the subpattern name keys.
To solve this, detect this situation and duplicate the strings.
Closes GH-17132.
This commit[1] and the related part of the Netware removal[2] move the
related definitions out of gd.h, and bring some updates.
[1] <2a921c80fb>
[2] <e6bb110663>
We apply the same fix that has been applied to external libgd at least
as of 2.0.29.
To avoid issues regarding minor FreeType rendering differences, the
test case does not compare against an image, but rather checks that all
pixels outside the clipping rect have the background color.
Closes GH-17374.
- socket_addrinfo_lookup throws when hints is an indexed array.
- socket_get_option hardcoding size outputs to user when data
size known.
close GH-17363
At one point this served a purpose as it contained the cleanup code that
now lives in dtor, but now it just calls the standard handler so we can
just get rid of it.
This is a follow-up on GH-17343 to implement GC cycle management.
Previously the objects lived too long due to the strong cycle.
This patch adds get_gc handlers to break the cycle.
Closes GH-17355.
This is porting the relevant part of a previous upstream commit[1] to
align the behavior of our bundled libgd with upstream. It should be
noted that this only works if the image actually has a transparent
color.
[1] <4770e2b2d5>
Closes GH-17351.
The segfault happens because zoi->wrapping_obj points to an object that has been freed.
This wrapping_obj is set in IntlIterator_from_StringEnumeration().
Notice how the refcount is not increased in this function.
By switching to ZVAL_OBJ_COPY, the segfault disappears.
We also need to move the responsibility of destroying the iterator to
the iterator itself and keep the object data destruction in the object
destruction. The existing code used a weird recursive destruction
between the iterator and object that was too hard to understand to be
honest. This patch simplifies everything and in the process gets rid of
the leak.
Iterators that are embedded are now responsible for their own
memory cleanup.
Closes GH-17343.
This is not a functional change, but rather a performance improvement,
to avoid unnecessary calls of `gdImageSetPixel()` which would be no-ops
due to positions outside of the clipping bounds.
This is basically a port of the "Small code cleanup" commit[1].
We can now drop the superfluous checks for zero width/height. These
have been introduced as fix for bug 72337[2], while the same issue had
a simpler fix for upstream[3], because the helper functions already
were internal.
[1] <e054be7d82>
[2] <https://bugs.php.net/72337>
[3] <77309c419c>
That bug has been potentially exploitable[1], but the GD extension was
not affected by that, because `gdImageBmpPtr()` is never called. Still
it seems to be reasonable to port the fix; if only to keep bundled and
external libgd synced.
[1] <https://github.com/advisories/GHSA-hc3p-jvff-jfw5>
