Fixed bug #67024 - getimagesize should recognize BMP files with negative height

NEWS

@@ -8,6 +8,8 @@ PHP                                                                        NEWS
     UNIX sockets). (Mike)
   . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)
   . Fixed bug #66736 (fpassthru broken). (Mike)
+  . Fixed bug #67024 (getimagesize should recognize BMP files with negative 
+    height). (Gabor Buella)
 
 - Embed:
   . Fixed bug #65715 (php5embed.lib isn't provided anymore). (Anatol)

ext/standard/image.c

@@ -163,6 +163,7 @@ static struct gfxinfo *php_handle_bmp (php_stream * stream TSRMLS_DC)
 		result = (struct gfxinfo *) ecalloc (1, sizeof(struct gfxinfo));
 		result->width    =  (((unsigned int)dim[ 7]) << 24) + (((unsigned int)dim[ 6]) << 16) + (((unsigned int)dim[ 5]) << 8) + ((unsigned int) dim[ 4]);
 		result->height   =  (((unsigned int)dim[11]) << 24) + (((unsigned int)dim[10]) << 16) + (((unsigned int)dim[ 9]) << 8) + ((unsigned int) dim[ 8]);
+		result->height   =  abs((int32_t)result->height);
 		result->bits     =  (((unsigned int)dim[15]) <<  8) +  ((unsigned int)dim[14]);
 	} else {
 		return NULL;

ext/standard/tests/image/getimagesize.phpt

@@ -23,7 +23,22 @@ GetImageSize()
 	var_dump($result);
 ?>
 --EXPECT--
-array(12) {
+array(13) {
+  ["test-1pix.bmp"]=>
+  array(6) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(1)
+    [2]=>
+    int(6)
+    [3]=>
+    string(20) "width="1" height="1""
+    ["bits"]=>
+    int(24)
+    ["mime"]=>
+    string(14) "image/x-ms-bmp"
+  }
   ["test1bpix.bmp"]=>
   array(6) {
     [0]=>

ext/standard/tests/image/image_type_to_mime_type.phpt

@@ -25,7 +25,9 @@ image_type_to_mime_type()
 	var_dump($result);
 ?>
 --EXPECT--
-array(12) {
+array(13) {
+  ["test-1pix.bmp"]=>
+  string(14) "image/x-ms-bmp"
   ["test1bpix.bmp"]=>
   string(14) "image/x-ms-bmp"
   ["test1pix.bmp"]=>