Fix shift UB in gd_io.c

nikic · nikic · commit ea97fc9c1f78 · 2019-06-19T15:09:00.000+02:00
This has already been fixed upstream in libgd/libgd@24d3525 and libgd/libgd@772d010.
diff --git a/ext/gd/libgd/gd_io.c b/ext/gd/libgd/gd_io.c
@@ -117,7 +117,7 @@ int gdGetWordLSB(signed short int *result, gdIOCtx *ctx)
 
 int gdGetInt (int *result, gdIOCtx * ctx)
 {
-	int r;
+	unsigned int r;
 	r = (ctx->getC) (ctx);
 	GD_IO_EOF_CHK(r);
 	*result = r << 24;
@@ -141,7 +141,7 @@ int gdGetInt (int *result, gdIOCtx * ctx)
 
 int gdGetIntLSB(signed int *result, gdIOCtx *ctx)
 {
-	int c = 0;
+	unsigned int c;
 	unsigned int r = 0;
 
 	c = (ctx->getC) (ctx);

Original file line number	Diff line number	Diff line change
`@@ -117,7 +117,7 @@ int gdGetWordLSB(signed short int result, gdIOCtx ctx)`
`117`	`117`
`118`	`118`	`int gdGetInt (int result, gdIOCtx ctx)`
`119`	`119`	`{`
`120`		`- int r;`
	`120`	`+ unsigned int r;`
`121`	`121`	`r = (ctx->getC) (ctx);`
`122`	`122`	`GD_IO_EOF_CHK(r);`
`123`	`123`	`*result = r << 24;`
`@@ -141,7 +141,7 @@ int gdGetInt (int result, gdIOCtx ctx)`
`141`	`141`
`142`	`142`	`int gdGetIntLSB(signed int result, gdIOCtx ctx)`
`143`	`143`	`{`
`144`		`- int c = 0;`
	`144`	`+ unsigned int c;`
`145`	`145`	`unsigned int r = 0;`
`146`	`146`
`147`	`147`	`c = (ctx->getC) (ctx);`