| 1 | Patch-Source: https://github.com/php/php-src/commit/fcd691b377d02285740744bee17c0f298be227d5
|
| 2 | From 5e25a79a5c01a5a8ccbed2bc80222b5cee9fb29c Mon Sep 17 00:00:00 2001
|
| 3 | From: Ilija Tovilo <[email protected]>
|
| 4 | Date: Tue, 28 Jul 2026 02:48:11 +0200
|
| 5 | Subject: [PATCH 1/4] libgd patch for CVE-2026-9672
|
| 6 |
|
| 7 | Patch by Pierre Joye (pierrejoye).
|
| 8 |
|
| 9 | (cherry picked from commit fcd691b377d02285740744bee17c0f298be227d5)
|
| 10 | ---
|
| 11 | ext/gd/libgd/gd_gif_in.c | 6 ++++--
|
| 12 | 1 file changed, 4 insertions(+), 2 deletions(-)
|
| 13 |
|
| 14 | diff --git a/ext/gd/libgd/gd_gif_in.c b/ext/gd/libgd/gd_gif_in.c
|
| 15 | index 1f697236107..e055f902445 100644
|
| 16 | |
| 17 | |
| 18 | @@ -450,7 +450,7 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
|
| 19 | sd->table[1][i] = i;
|
| 20 | }
|
| 21 | for (; i < (1<<MAX_LWZ_BITS); ++i)
|
| 22 | - sd->table[0][i] = sd->table[1][0] = 0;
|
| 23 | + sd->table[0][i] = sd->table[1][i] = 0;
|
| 24 |
|
| 25 | sd->sp = sd->stack;
|
| 26 |
|
| 27 | @@ -494,6 +494,8 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i
|
| 28 |
|
| 29 | if (count != 0)
|
| 30 | return -2;
|
| 31 | +
|
| 32 | + return -2;
|
| 33 | }
|
| 34 |
|
| 35 | incode = code;
|
| 36 | @@ -560,7 +562,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
|
| 37 | int v;
|
| 38 | int xpos = 0, ypos = 0, pass = 0;
|
| 39 | int i;
|
| 40 | - LZW_STATIC_DATA sd;
|
| 41 | + LZW_STATIC_DATA sd = {0};
|
| 42 |
|
| 43 |
|
| 44 | /*
|