Newsgroups: php.internals,php.internals.win
Path: news.php.net
Xref: news.php.net php.internals:125502 php.internals.win:1299
Message-ID: <b5d7d433-5fb2-4fd8-8b36-81249a68116d@gmx.de>
Date: Wed, 11 Sep 2024 14:55:08 +0200
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: PHP internals list <internals@lists.php.net>
Content-Language: de-DE
Cc: internals-win <internals-win@lists.php.net>
Subject: [PHP-DEV] ext/gd: drop XPM support on Windows
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
UI-OutboundReport: notjunk:1;M01:P0:dnVRnBZ2rfg=;J3fkuOdHFPnIfJiJ+YYjcMvcnce
 T0XsMRsLIMq8c3qlmbcOteYBDRHNhHzwSxBNYs2d6c2Tp60xu88MQk19MmbTL2Tfz7ZFD2HNC
 oz/i0YEMbvddpkfj1cieWD6/4caYPAnKuvnQmvjSF91NMZF1WvEey6nxWlgnPoHu030jXx8hU
 eNFLsPcHa6tZ2Etk+wLPF9OHvqrpfJMgdspvMYzPUYGl6jXbn6QumKy1HmjpavW26ftjqL1XW
 jSZCMPQWEnzs4Vy1rv88uDQpoX6bS8wsBZd4v8SG2z6j+TINnzPg7YLtxSr5IJWJwXc0cOcog
 UeSBiZZVzSIpKCJlHzl3OprF1fOkNCSZGDJyVu/FNML95rnyGylhobgMkrltCuDjX7dGiic1u
 kQ8m4EcomnxMG1OlqDKs/pT3La9bNr6Pi77fJtMnHd57AQBXcofhAIwmWBbJtw2JGTV50LIHV
 MiTgROMCjqL7lSZjFVRBd1CaKccOF0dhh76Cg68A8CV5pPHlvxxgaTXcyb6xE85ap1WDZimg9
 qOJJv6VnAk3tcIS35qARldUPi+NwdpflBWJhpjhECTCYXy0IoTpsfh6Da3Mol7YO/fUq/ymE4
 ecg9LsyEgnbUHdf3XPzPVNdTQzTdeJsOki2EsUkXQFga6F/oG/TFhLYiaI+eXgzGFdZRzP9Tk
 rqTEZpP3oiELGU4sAOnttCre6dn/eHDL3mQfN+Hljmaua3uc9oZc24jyY6SwRXYZHI3HnzIlO
 Z1+cfRqrMbHFk1mKiYKxC0Caccf7VPKLjBfypeRGM4MkbSXK51lAPTZRALLkfjRJOkjkWbLU0
 xkjyumrSrnX8q0XqfkN/RoIAhdCZwRkRlIfNdO8iOV7PQ=
From: cmbecker69@gmx.de ("Christoph M. Becker")

Hi all,

I'm in the progress of updating all libraries required for ext/gd on
Windows.  Since libxpm hasn't been updated for quite a while (we're
still shipping libxpm 3.5.12), I've attempted updating to libxpm 3.5.17.
 However, besides the already existing mess of needing to fetch several
X11 header files from other repos, I've noticed that support for FOR_MSW
builds has completely been dropped[1].  That makes it even harder to
have a somewhat clean build.

Looking a bit further, I've noticed that three vulnerabilites have been
fixed in libxpm 3.5.15[2]; the third one doesn't affect our builds, but
the first two likely do, causing potential DoS, if crafted XPM images
are read by imagecreatefromxpm() (but not by imagecreatefromstring()
since this doesn't support XPM).  While it should be possible to upgrade
to libxpm 3.5.15 (or at least to backport the respective fixes), I don't
think it makes sense to move forward supporting XPM images with ext/gd
on Windows.  Besides that this format is typically used on Linux, it is
grossly out-dated.  Even Gif is way superior, let alone PNG.

Therefore I suggest dropping XPM support from ext/gd on Windows as soon
as possible (might be a bit late for PHP 8.4, but might still be a good
idea).  Note that XBM support is unrelated, since this is handled by the
bundled libgd without relying on any library.  Also note that
getimagesize() is also not affected, since it doesn't support XPM anyway.

Any objections, or general thoughts?

[1]
<https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/b30fd0918f8d99aa718ede3da30f9d29f87063e1>
[2] <https://lists.x.org/archives/xorg-announce/2023-January/003312.html>

Christoph