Merge branch 'PHP-5.4' into PHP-5.5

* PHP-5.4: Fixed bug #67024 - getimagesize should recognize BMP files with negative height

Author: smalyshev

NEWS

@@ -7,6 +7,8 @@ PHP NEWS
  UNIX sockets). (Mike)
  . Fixed bug #66182 (exit in stream filter produces segfault). (Mike) 
  . Fixed bug #66736 (fpassthru broken). (Mike)
+ . Fixed bug #67024 (getimagesize should recognize BMP files with negative
+ height). (Gabor Buella)
  . Fixed bug #67043 (substr_compare broke by previous change) (Tjerk)
 
 - Embed:

ext/standard/image.c

@@ -163,6 +163,7 @@ static struct gfxinfo *php_handle_bmp (php_stream * stream TSRMLS_DC)
 result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
 result->width = (((unsigned int)dim[ 7]) << 24) + (((unsigned int)dim[ 6]) << 16) + (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
 result->height = (((unsigned int)dim[11]) << 24) + (((unsigned int)dim[10]) << 16) + (((unsigned int)dim[ 9]) << 8) + ((unsigned int) dim[ 8]);
+result->height = abs((int32_t)result->height);
 result->bits = (((unsigned int)dim[15]) << 8) + ((unsigned int)dim[14]);
 } else {
 return NULL;

ext/standard/tests/image/getimagesize.phpt

@@ -23,7 +23,22 @@ GetImageSize()
 var_dump($result);
 ?>
 --EXPECT--
-array(12) {
+array(13) {
+ ["test-1pix.bmp"]=>
+ array(6) {
+ [0]=>
+ int(1)
+ [1]=>
+ int(1)
+ [2]=>
+ int(6)
+ [3]=>
+ string(20) "width="1" height="1""
+ ["bits"]=>
+ int(24)
+ ["mime"]=>
+ string(14) "image/x-ms-bmp"
+ }
  ["test1bpix.bmp"]=>
  array(6) {
  [0]=>

ext/standard/tests/image/image_type_to_mime_type.phpt

@@ -25,7 +25,9 @@ image_type_to_mime_type()
 var_dump($result);
 ?>
 --EXPECT--
-array(12) {
+array(13) {
+ ["test-1pix.bmp"]=>
+ string(14) "image/x-ms-bmp"
  ["test1bpix.bmp"]=>
  string(14) "image/x-ms-bmp"
  ["test1pix.bmp"]=>