From 80815ac21cd72face9c589fad50bf84aafe1ce32 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Wed, 13 Nov 2024 15:26:56 +0100
Subject: [PATCH] Simplify WBMP imagecreatefromstring() detection

According to the WBMP specification[1], the first field (type) of a
WBMP is a multi-byte integer, but only type `0` is supported.  Thus
there is no need to read a multi-byte integer.  The second field (fix
header) is a single byte; reading a multi-byte integer is not really
wrong, since the fix header field is laid out in a way which allows it
to be treated as such, but the check whether the MBI is greater than
or equal to zero is pretty useless, because negative values could only
be returned if overflow occurs (MBIs are unsigned).

So the only useful assumption we can make is that the first byte is
zero; we let `gdImageCreateFromWBMPCtx()` figure out the rest.

[1] <https://www.wapforum.org/what/technical/SPEC-WAESpec-19990524.pdf> section 6
---
 ext/gd/gd.c                                  |  29 ++-----------------
 ext/gd/tests/imagecreatefromstring.wbmp      | Bin 0 -> 5006 bytes
 ext/gd/tests/imagecreatefromstring_wbmp.phpt |  19 ++++++++++++
 3 files changed, 21 insertions(+), 27 deletions(-)
 create mode 100644 ext/gd/tests/imagecreatefromstring.wbmp
 create mode 100644 ext/gd/tests/imagecreatefromstring_wbmp.phpt

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 093daeac41996..938672ccc0c7d 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1358,24 +1358,6 @@ PHP_FUNCTION(imagetypes)
 }
 /* }}} */
 
-/* {{{ _php_ctx_getmbi */
-
-static int _php_ctx_getmbi(gdIOCtx *ctx)
-{
-	int i, mbi = 0;
-
-	do {
-		i = (ctx->getC)(ctx);
-		if (i < 0 || mbi > (INT_MAX >> 7)) {
-			return -1;
-		}
-		mbi = (mbi << 7) | (i & 0x7f);
-	} while (i & 0x80);
-
-	return mbi;
-}
-/* }}} */
-
 /* {{{ _php_image_type
  * Based on ext/standard/image.c
  */
@@ -1413,15 +1395,8 @@ static int _php_image_type(zend_string *data)
 		}
 	}
 
-	gdIOCtx *io_ctx;
-	io_ctx = gdNewDynamicCtxEx(8, ZSTR_VAL(data), 0);
-	if (io_ctx) {
-		if (_php_ctx_getmbi(io_ctx) == 0 && _php_ctx_getmbi(io_ctx) >= 0) {
-			io_ctx->gd_free(io_ctx);
-			return PHP_GDIMG_TYPE_WBM;
-		} else {
-			io_ctx->gd_free(io_ctx);
-		}
+	if (ZSTR_VAL(data)[0] == 0) {
+		return PHP_GDIMG_TYPE_WBM;
 	}
 
 	return -1;
diff --git a/ext/gd/tests/imagecreatefromstring.wbmp b/ext/gd/tests/imagecreatefromstring.wbmp
new file mode 100644
index 0000000000000000000000000000000000000000..f1af776b7f20c8d01215d644f6342f936d2052f2
GIT binary patch
literal 5006
xcmeIuF#!Mo2m_$STP>4o3O|TIGMz343>YwAz<>b*1`HT5V8DO@0|pGd4;%(RcPIb=

literal 0
HcmV?d00001

diff --git a/ext/gd/tests/imagecreatefromstring_wbmp.phpt b/ext/gd/tests/imagecreatefromstring_wbmp.phpt
new file mode 100644
index 0000000000000..07bf3f7e196df
--- /dev/null
+++ b/ext/gd/tests/imagecreatefromstring_wbmp.phpt
@@ -0,0 +1,19 @@
+--TEST--
+imagecreatefromstring() - WBMP format
+--EXTENSIONS--
+gd
+--SKIPIF--
+<?php
+if (!(imagetypes() & IMG_WBMP)) die('skip GIF support required');
+?>
+--FILE--
+<?php
+// create an image from a WBMP string representation
+$im = imagecreatefromstring(file_get_contents(__DIR__ . '/imagecreatefromstring.wbmp'));
+var_dump(imagesx($im));
+var_dump(imagesy($im));
+
+?>
+--EXPECT--
+int(200)
+int(200)