? t
? libgd/.gd_io_dp.c.swp
? libgd/.gd_png.c.swp
Index: gd.c
===================================================================
RCS file: /repository/php-src/ext/gd/gd.c,v
retrieving revision 1.312.2.20.2.9
diff -u -u -p -r1.312.2.20.2.9 gd.c
--- gd.c	3 Nov 2006 15:13:17 -0000	1.312.2.20.2.9
+++ gd.c	9 Dec 2006 12:02:45 -0000
@@ -2249,6 +2249,11 @@ gdImagePtr _php_image_create_from_string
 	im = (*ioctx_func_p)(io_ctx);
 	if (!im) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Passed data is not in '%s' format", tn);
+#if HAVE_LIBGD204
+		io_ctx->gd_free(io_ctx);
+#else
+		io_ctx->free(io_ctx);
+#endif
 		return NULL;
 	}
 
Index: libgd/gd_png.c
===================================================================
RCS file: /repository/php-src/ext/gd/libgd/gd_png.c,v
retrieving revision 1.17.4.2.2.3
diff -u -u -p -r1.17.4.2.2.3 gd_png.c
--- libgd/gd_png.c	5 Nov 2006 15:04:50 -0000	1.17.4.2.2.3
+++ libgd/gd_png.c	9 Dec 2006 12:02:45 -0000
@@ -58,7 +58,7 @@ static void gdPngErrorHandler (png_struc
 	 * been defined.
 	 */
 
-	php_gd_error_ex(E_ERROR, "gd-png:  fatal libpng error: %s", msg);
+	php_gd_error_ex(E_WARNING, "gd-png:  fatal libpng error: %s", msg);
 
 	jmpbuf_ptr = png_get_error_ptr (png_ptr);
 	if (jmpbuf_ptr == NULL) { /* we are completely hosed now */
@@ -200,6 +200,23 @@ gdImagePtr gdImageCreateFromPngCtx (gdIO
 		png_set_packing (png_ptr); /* expand to 1 byte per pixel */
 	}
 
+	/* setjmp() must be called in every non-callback function that calls a
+	 * PNG-reading libpng function
+	 */
+#ifndef PNG_SETJMP_NOT_SUPPORTED
+	if (setjmp(gdPngJmpbufStruct.jmpbuf)) {
+		php_gd_error("gd-png error: setjmp returns error condition");
+		png_destroy_read_struct(&png_ptr, &info_ptr, NULL);
+		gdFree(image_data);
+		gdFree(row_pointers);
+		if (im) {
+			gdImageDestroy(im);
+		}
+		return NULL;
+	}
+#endif
+
+
 	switch (color_type) {
 		case PNG_COLOR_TYPE_PALETTE:
 			png_get_PLTE(png_ptr, info_ptr, &palette, &num_palette);