Sun May 11 11:20:48 2014 UTC ()
Apply a patch to fix CVE-2014-2497, taken from
https://bugs.php.net/patch-display.php?bug_id=66901
Bump PKGREVISION for php-gd correspondingly.


(he)
diff -r1.35 -r1.36 pkgsrc/graphics/php-gd/Makefile
diff -r1.72 -r1.73 pkgsrc/lang/php53/distinfo
diff -r0 -r1.1 pkgsrc/lang/php53/patches/patch-ext_gd_libgd_gdxpm.c
diff -r1.38 -r1.39 pkgsrc/lang/php54/distinfo
diff -r0 -r1.1 pkgsrc/lang/php54/patches/patch-ext_gd_libgd_gdxpm.c
diff -r1.20 -r1.21 pkgsrc/lang/php55/distinfo
diff -r0 -r1.1 pkgsrc/lang/php55/patches/patch-ext_gd_libgd_gdxpm.c
cvs diff -r1.35 -r1.36 pkgsrc/graphics/php-gd/Makefile (expand / switch to unified diff)

--- pkgsrc/graphics/php-gd/Makefile 2013/06/07 13:55:45 1.35
+++ pkgsrc/graphics/php-gd/Makefile 2014/05/11 11:20:47 1.36
@@ -1,18 +1,19 @@ @@ -1,18 +1,19 @@
1# $NetBSD: Makefile,v 1.35 2013/06/07 13:55:45 taca Exp $ 1# $NetBSD: Makefile,v 1.36 2014/05/11 11:20:47 he Exp $
2 2
3MODNAME= gd 3MODNAME= gd
4CATEGORIES+= graphics 4CATEGORIES+= graphics
5COMMENT= PHP extension for GD graphics library 5COMMENT= PHP extension for GD graphics library
 6PKGREVISION= 1
6 7
7CONFLICTS= php-gd-[0-9]* 8CONFLICTS= php-gd-[0-9]*
8 9
9# XXX we use bundled GD so that extension is usable also by non-threaded 10# XXX we use bundled GD so that extension is usable also by non-threaded
10# PHP, such as CLI/CGI version or ap-php on Apache 1.x. 11# PHP, such as CLI/CGI version or ap-php on Apache 1.x.
11 12
12CONFIGURE_ARGS+= --with-${MODNAME} 13CONFIGURE_ARGS+= --with-${MODNAME}
13CONFIGURE_ARGS+= --with-jpeg-dir=${BUILDLINK_DIR:Q} 14CONFIGURE_ARGS+= --with-jpeg-dir=${BUILDLINK_DIR:Q}
14CONFIGURE_ARGS+= --with-png-dir=${BUILDLINK_DIR:Q} 15CONFIGURE_ARGS+= --with-png-dir=${BUILDLINK_DIR:Q}
15CONFIGURE_ARGS+= --with-zlib-dir=${BUILDLINK_DIR:Q} 16CONFIGURE_ARGS+= --with-zlib-dir=${BUILDLINK_DIR:Q}
16CONFIGURE_ARGS+= --with-freetype-dir=${BUILDLINK_DIR:Q} 17CONFIGURE_ARGS+= --with-freetype-dir=${BUILDLINK_DIR:Q}
17CONFIGURE_ARGS+= --enable-${MODNAME}-native-ttf 18CONFIGURE_ARGS+= --enable-${MODNAME}-native-ttf
18CONFIGURE_ARGS+= --enable-${MODNAME}-jis-conv 19CONFIGURE_ARGS+= --enable-${MODNAME}-jis-conv
cvs diff -r1.72 -r1.73 pkgsrc/lang/php53/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/php53/Attic/distinfo 2014/03/23 09:55:59 1.72
+++ pkgsrc/lang/php53/Attic/distinfo 2014/05/11 11:20:47 1.73
@@ -1,27 +1,28 @@ @@ -1,27 +1,28 @@
1$NetBSD: distinfo,v 1.72 2014/03/23 09:55:59 spz Exp $ 1$NetBSD: distinfo,v 1.73 2014/05/11 11:20:47 he Exp $
2 2
3SHA1 (php-5.3.28.tar.bz2) = f985ca1f6a5f49ebfb25a08f1837a44c563b31f8 3SHA1 (php-5.3.28.tar.bz2) = f985ca1f6a5f49ebfb25a08f1837a44c563b31f8
4RMD160 (php-5.3.28.tar.bz2) = e4910c0c365f39a5009807801bd5ee6e25be020d 4RMD160 (php-5.3.28.tar.bz2) = e4910c0c365f39a5009807801bd5ee6e25be020d
5Size (php-5.3.28.tar.bz2) = 11051714 bytes 5Size (php-5.3.28.tar.bz2) = 11051714 bytes
6SHA1 (suhosin-patch-5.3.25-0.9.10.patch.bz2) = ce5883b05daf91e8a44fffbfa4d3989ac3311dd1 6SHA1 (suhosin-patch-5.3.25-0.9.10.patch.bz2) = ce5883b05daf91e8a44fffbfa4d3989ac3311dd1
7RMD160 (suhosin-patch-5.3.25-0.9.10.patch.bz2) = 6c4d0cfe070802481121be465b66d3cefe44da83 7RMD160 (suhosin-patch-5.3.25-0.9.10.patch.bz2) = 6c4d0cfe070802481121be465b66d3cefe44da83
8Size (suhosin-patch-5.3.25-0.9.10.patch.bz2) = 32447 bytes 8Size (suhosin-patch-5.3.25-0.9.10.patch.bz2) = 32447 bytes
9SHA1 (patch-aa) = fd930d0d9b1c60e8c7c514cfb6864b61ce4d158d 9SHA1 (patch-aa) = fd930d0d9b1c60e8c7c514cfb6864b61ce4d158d
10SHA1 (patch-ab) = 36789fea71e316d5c4358e597df1928d94f8ea6a 10SHA1 (patch-ab) = 36789fea71e316d5c4358e597df1928d94f8ea6a
11SHA1 (patch-ac) = b194eaed2d81877166b13db58b37c5ddff0210a6 11SHA1 (patch-ac) = b194eaed2d81877166b13db58b37c5ddff0210a6
12SHA1 (patch-aclocal.m4) = 473b76c8575331604d30e24a08c527e15b166778 12SHA1 (patch-aclocal.m4) = 473b76c8575331604d30e24a08c527e15b166778
13SHA1 (patch-ad) = 6b42868f41335ddfa5a8c1e982819166b05e4ad2 13SHA1 (patch-ad) = 6b42868f41335ddfa5a8c1e982819166b05e4ad2
14SHA1 (patch-ae) = 3a354cb5c1253eb375041d8ee8549c2f663e6c74 14SHA1 (patch-ae) = 3a354cb5c1253eb375041d8ee8549c2f663e6c74
15SHA1 (patch-af) = 4f5aac4c52ce576f4489cb1f06fdb672745a8fdb 15SHA1 (patch-af) = 4f5aac4c52ce576f4489cb1f06fdb672745a8fdb
16SHA1 (patch-ag) = 84af84bc1144ac8a1fce931edcedd4a3ad0f2fda 16SHA1 (patch-ag) = 84af84bc1144ac8a1fce931edcedd4a3ad0f2fda
17SHA1 (patch-ah) = 697156508da2d837a1ea1a41f036eab4fb87e94b 17SHA1 (patch-ah) = 697156508da2d837a1ea1a41f036eab4fb87e94b
18SHA1 (patch-ai) = 9659f73eef1b4fcca9b844bdaa785ac6d5e582a1 18SHA1 (patch-ai) = 9659f73eef1b4fcca9b844bdaa785ac6d5e582a1
19SHA1 (patch-aj) = 181658ae523bd60f67750566711fc078b49191b7 19SHA1 (patch-aj) = 181658ae523bd60f67750566711fc078b49191b7
20SHA1 (patch-al) = fe534d7d50a529e3c7d0ffed76afdb70bb55a521 20SHA1 (patch-al) = fe534d7d50a529e3c7d0ffed76afdb70bb55a521
21SHA1 (patch-build_libtool.m4) = 6835b90ebd34739440c8eb94ed19ebacdf2ba6a5 21SHA1 (patch-build_libtool.m4) = 6835b90ebd34739440c8eb94ed19ebacdf2ba6a5
22SHA1 (patch-ext_date_lib_parse__iso__intervals.c) = 1243e4cda1d6446ee4f8b6cab61556fa07837139 22SHA1 (patch-ext_date_lib_parse__iso__intervals.c) = 1243e4cda1d6446ee4f8b6cab61556fa07837139
23SHA1 (patch-ext_date_lib_parse__iso__intervals.re) = 75d4abd666c17d7d5f8a4ee9e489bf2565f83524 23SHA1 (patch-ext_date_lib_parse__iso__intervals.re) = 75d4abd666c17d7d5f8a4ee9e489bf2565f83524
 24SHA1 (patch-ext_gd_libgd_gdxpm.c) = 9a175417fad9ac23037a24122f8d1258b9eebbcb
24SHA1 (patch-ext_standard_basic__functions.c) = 017fd25e646af4d7eb2a0bd13b3c8da34eaee8c5 25SHA1 (patch-ext_standard_basic__functions.c) = 017fd25e646af4d7eb2a0bd13b3c8da34eaee8c5
25SHA1 (patch-main_streams_cast.c) = d68b69c9418a8780b1610b8755487771f7c46a5a 26SHA1 (patch-main_streams_cast.c) = d68b69c9418a8780b1610b8755487771f7c46a5a
26SHA1 (patch-php__mssql.c) = 524c4e5d7ede0e503049bf1febec58e0c4a29aa4 27SHA1 (patch-php__mssql.c) = 524c4e5d7ede0e503049bf1febec58e0c4a29aa4
27SHA1 (patch-sapi_fpm_php-fpm.conf.in) = 86137a37e74badf99c46d1ba7ca5d85f42bedfce 28SHA1 (patch-sapi_fpm_php-fpm.conf.in) = 86137a37e74badf99c46d1ba7ca5d85f42bedfce
File Added: pkgsrc/lang/php53/patches/Attic/patch-ext_gd_libgd_gdxpm.c
$NetBSD: patch-ext_gd_libgd_gdxpm.c,v 1.1 2014/05/11 11:20:47 he Exp $

Patch to fix CVE-2014-2497, taken from
https://bugs.php.net/patch-display.php?bug_id=66901

--- ext/gd/libgd/gdxpm.c.orig	2014-04-29 08:04:30.000000000 +0000
+++ ext/gd/libgd/gdxpm.c
@@ -39,6 +39,13 @@ gdImagePtr gdImageCreateFromXpm (char *f
 	number = image.ncolors;
 	colors = (int *) safe_emalloc(number, sizeof(int), 0);
 	for (i = 0; i < number; i++) {
+		if (!image.colorTable[i].c_color)
+		{
+			/* unsupported color key or color key not defined */
+			gdImageDestroy(im);
+			im = 0;
+			goto done;
+		}
 		switch (strlen (image.colorTable[i].c_color)) {
 			case 4:
 				buf[1] = '\0';
@@ -125,8 +132,8 @@ gdImagePtr gdImageCreateFromXpm (char *f
 		}
 	}
 
-	gdFree(colors);
  done:
+	gdFree(colors);
 	XpmFreeXpmImage(&image);
 	XpmFreeXpmInfo(&info);
 	return im;
cvs diff -r1.38 -r1.39 pkgsrc/lang/php54/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/php54/Attic/distinfo 2014/05/02 13:04:12 1.38
+++ pkgsrc/lang/php54/Attic/distinfo 2014/05/11 11:20:47 1.39
@@ -1,22 +1,23 @@ @@ -1,22 +1,23 @@
1$NetBSD: distinfo,v 1.38 2014/05/02 13:04:12 taca Exp $ 1$NetBSD: distinfo,v 1.39 2014/05/11 11:20:47 he Exp $
2 2
3SHA1 (php-5.4.28.tar.bz2) = 857d458b0daf89f36f8d652c5d8bd5fe509bc691 3SHA1 (php-5.4.28.tar.bz2) = 857d458b0daf89f36f8d652c5d8bd5fe509bc691
4RMD160 (php-5.4.28.tar.bz2) = 22f3ac1c56b104a9fa615a26aa90b5591dea29ef 4RMD160 (php-5.4.28.tar.bz2) = 22f3ac1c56b104a9fa615a26aa90b5591dea29ef
5Size (php-5.4.28.tar.bz2) = 12266216 bytes 5Size (php-5.4.28.tar.bz2) = 12266216 bytes
6SHA1 (patch-acinclude.m4) = 71635e5381abf99a9fc9f2537b1c2f18e8096f00 6SHA1 (patch-acinclude.m4) = 71635e5381abf99a9fc9f2537b1c2f18e8096f00
7SHA1 (patch-aclocal.m4) = eae2ed8ea2985933c4fe88ba52577c14ac88eb92 7SHA1 (patch-aclocal.m4) = eae2ed8ea2985933c4fe88ba52577c14ac88eb92
8SHA1 (patch-build_libtool.m4) = 6dfef7c07a42dc54611c104265ef43c50a4e88ca 8SHA1 (patch-build_libtool.m4) = 6dfef7c07a42dc54611c104265ef43c50a4e88ca
9SHA1 (patch-configure) = 7d14d78b6bb1b70d8467afb7baf54e51f313542c 9SHA1 (patch-configure) = 7d14d78b6bb1b70d8467afb7baf54e51f313542c
10SHA1 (patch-ext_gd_config.m4) = 2353efe6f25e1081b41d61033c3185cc643c7891 10SHA1 (patch-ext_gd_config.m4) = 2353efe6f25e1081b41d61033c3185cc643c7891
 11SHA1 (patch-ext_gd_libgd_gdxpm.c) = 9a175417fad9ac23037a24122f8d1258b9eebbcb
11SHA1 (patch-ext_imap_config.m4) = 01681e8b54ee586ec4db72a5da2d0aec3fa89fcc 12SHA1 (patch-ext_imap_config.m4) = 01681e8b54ee586ec4db72a5da2d0aec3fa89fcc
12SHA1 (patch-ext_mssql_php__mssql.c) = 732e48b05086180585a3087c2e9737db557dbc3b 13SHA1 (patch-ext_mssql_php__mssql.c) = 732e48b05086180585a3087c2e9737db557dbc3b
13SHA1 (patch-ext_pdo__mysql_config.m4) = 3526e737da25129710218e7141d5a05ae0a51390 14SHA1 (patch-ext_pdo__mysql_config.m4) = 3526e737da25129710218e7141d5a05ae0a51390
14SHA1 (patch-ext_pdo_config.m4) = 26a4ad02e5c6b7a54c3c54a6d026a3ccfed62c59 15SHA1 (patch-ext_pdo_config.m4) = 26a4ad02e5c6b7a54c3c54a6d026a3ccfed62c59
15SHA1 (patch-ext_phar_Makefile.frag) = 1af23d9135557bc7ba2f3627b317d4cbef37aaba 16SHA1 (patch-ext_phar_Makefile.frag) = 1af23d9135557bc7ba2f3627b317d4cbef37aaba
16SHA1 (patch-ext_phar_phar_phar.php) = 011f2d68048dbc63f5efcab4e23062daa9e8e08c 17SHA1 (patch-ext_phar_phar_phar.php) = 011f2d68048dbc63f5efcab4e23062daa9e8e08c
17SHA1 (patch-ext_standard_basic__functions.c) = 563fe67eb78b786cd46195026381ef22128e0841 18SHA1 (patch-ext_standard_basic__functions.c) = 563fe67eb78b786cd46195026381ef22128e0841
18SHA1 (patch-php.ini-development) = 056a74646cbeb0b2bcfc18463348343d817b54bc 19SHA1 (patch-php.ini-development) = 056a74646cbeb0b2bcfc18463348343d817b54bc
19SHA1 (patch-php.ini-production) = ac61016e18077a0870b8c8c42e89e3848c26d1f2 20SHA1 (patch-php.ini-production) = ac61016e18077a0870b8c8c42e89e3848c26d1f2
20SHA1 (patch-run-tests.php) = ff80b8ad52d7c0a43fa318ed9bffca9d7b3e688d 21SHA1 (patch-run-tests.php) = ff80b8ad52d7c0a43fa318ed9bffca9d7b3e688d
21SHA1 (patch-sapi_cgi_Makefile.frag) = c271096b8565e89a85b0189c6f503f3fb5cd4b27 22SHA1 (patch-sapi_cgi_Makefile.frag) = c271096b8565e89a85b0189c6f503f3fb5cd4b27
22SHA1 (patch-sapi_fpm_php-fpm.conf.in) = 2369bb6a426a7fb47dc73c88f0daa0f6fa67b593 23SHA1 (patch-sapi_fpm_php-fpm.conf.in) = 2369bb6a426a7fb47dc73c88f0daa0f6fa67b593
File Added: pkgsrc/lang/php54/patches/Attic/patch-ext_gd_libgd_gdxpm.c
$NetBSD: patch-ext_gd_libgd_gdxpm.c,v 1.1 2014/05/11 11:20:47 he Exp $

Patch to fix CVE-2014-2497, taken from
https://bugs.php.net/patch-display.php?bug_id=66901

--- ext/gd/libgd/gdxpm.c.orig	2014-04-29 08:04:30.000000000 +0000
+++ ext/gd/libgd/gdxpm.c
@@ -39,6 +39,13 @@ gdImagePtr gdImageCreateFromXpm (char *f
 	number = image.ncolors;
 	colors = (int *) safe_emalloc(number, sizeof(int), 0);
 	for (i = 0; i < number; i++) {
+		if (!image.colorTable[i].c_color)
+		{
+			/* unsupported color key or color key not defined */
+			gdImageDestroy(im);
+			im = 0;
+			goto done;
+		}
 		switch (strlen (image.colorTable[i].c_color)) {
 			case 4:
 				buf[1] = '\0';
@@ -125,8 +132,8 @@ gdImagePtr gdImageCreateFromXpm (char *f
 		}
 	}
 
-	gdFree(colors);
  done:
+	gdFree(colors);
 	XpmFreeXpmImage(&image);
 	XpmFreeXpmInfo(&info);
 	return im;
cvs diff -r1.20 -r1.21 pkgsrc/lang/php55/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/lang/php55/Attic/distinfo 2014/05/01 15:52:33 1.20
+++ pkgsrc/lang/php55/Attic/distinfo 2014/05/11 11:20:47 1.21
@@ -1,23 +1,24 @@ @@ -1,23 +1,24 @@
1$NetBSD: distinfo,v 1.20 2014/05/01 15:52:33 taca Exp $ 1$NetBSD: distinfo,v 1.21 2014/05/11 11:20:47 he Exp $
2 2
3SHA1 (php-5.5.12.tar.bz2) = eaa0b27368f98af2fa9aa6f08d7ea23bdb53c748 3SHA1 (php-5.5.12.tar.bz2) = eaa0b27368f98af2fa9aa6f08d7ea23bdb53c748
4RMD160 (php-5.5.12.tar.bz2) = c09c98e85c503cf030b0f215fcab0986945ce7ba 4RMD160 (php-5.5.12.tar.bz2) = c09c98e85c503cf030b0f215fcab0986945ce7ba
5Size (php-5.5.12.tar.bz2) = 13251734 bytes 5Size (php-5.5.12.tar.bz2) = 13251734 bytes
6SHA1 (patch-acinclude.m4) = 9e9c433e4cb96e469f7cf14b2064a0f41fc4568a 6SHA1 (patch-acinclude.m4) = 9e9c433e4cb96e469f7cf14b2064a0f41fc4568a
7SHA1 (patch-aclocal.m4) = 14ae2898e1d68b552e76a7e4ee7006f1aee1f932 7SHA1 (patch-aclocal.m4) = 14ae2898e1d68b552e76a7e4ee7006f1aee1f932
8SHA1 (patch-build_libtool.m4) = 6ee935c55cc01704c6e9edb4e383b2ddb7c746e7 8SHA1 (patch-build_libtool.m4) = 6ee935c55cc01704c6e9edb4e383b2ddb7c746e7
9SHA1 (patch-configure) = 7b4bef368e6709c26c0db31a4c7ebc04e4d55e9c 9SHA1 (patch-configure) = 7b4bef368e6709c26c0db31a4c7ebc04e4d55e9c
10SHA1 (patch-ext_gd_config.m4) = 91c9798333d4776856a0a9e20196986856b758b2 10SHA1 (patch-ext_gd_config.m4) = 91c9798333d4776856a0a9e20196986856b758b2
 11SHA1 (patch-ext_gd_libgd_gdxpm.c) = 9a175417fad9ac23037a24122f8d1258b9eebbcb
11SHA1 (patch-ext_imap_config.m4) = 01681e8b54ee586ec4db72a5da2d0aec3fa89fcc 12SHA1 (patch-ext_imap_config.m4) = 01681e8b54ee586ec4db72a5da2d0aec3fa89fcc
12SHA1 (patch-ext_mssql_php__mssql.c) = 4ef1837850443e9db2e71620a3ddaed5ab5c435b 13SHA1 (patch-ext_mssql_php__mssql.c) = 4ef1837850443e9db2e71620a3ddaed5ab5c435b
13SHA1 (patch-ext_opcache_config.m4) = 7c0d98feaeec8a0ca61f6f77a1906aa2d601be3f 14SHA1 (patch-ext_opcache_config.m4) = 7c0d98feaeec8a0ca61f6f77a1906aa2d601be3f
14SHA1 (patch-ext_pdo__mysql_config.m4) = 3526e737da25129710218e7141d5a05ae0a51390 15SHA1 (patch-ext_pdo__mysql_config.m4) = 3526e737da25129710218e7141d5a05ae0a51390
15SHA1 (patch-ext_pdo_config.m4) = 26a4ad02e5c6b7a54c3c54a6d026a3ccfed62c59 16SHA1 (patch-ext_pdo_config.m4) = 26a4ad02e5c6b7a54c3c54a6d026a3ccfed62c59
16SHA1 (patch-ext_phar_Makefile.frag) = 1af23d9135557bc7ba2f3627b317d4cbef37aaba 17SHA1 (patch-ext_phar_Makefile.frag) = 1af23d9135557bc7ba2f3627b317d4cbef37aaba
17SHA1 (patch-ext_phar_phar_phar.php) = 011f2d68048dbc63f5efcab4e23062daa9e8e08c 18SHA1 (patch-ext_phar_phar_phar.php) = 011f2d68048dbc63f5efcab4e23062daa9e8e08c
18SHA1 (patch-ext_sqlite3_libsqlite_sqlite3.c) = b384b9daa466f2a8a3e6cfd4ea6cff81f9342941 19SHA1 (patch-ext_sqlite3_libsqlite_sqlite3.c) = b384b9daa466f2a8a3e6cfd4ea6cff81f9342941
19SHA1 (patch-ext_standard_basic__functions.c) = f2a44998145306c2cb2d2f3822c0e7cc70c778b4 20SHA1 (patch-ext_standard_basic__functions.c) = f2a44998145306c2cb2d2f3822c0e7cc70c778b4
20SHA1 (patch-makedist) = 3f6b0621d30264824f2cb4c2903d15ba95be3937 21SHA1 (patch-makedist) = 3f6b0621d30264824f2cb4c2903d15ba95be3937
21SHA1 (patch-php.ini-development) = 4fc40f0af5f6e58b614794e066a5738694dc8ef8 22SHA1 (patch-php.ini-development) = 4fc40f0af5f6e58b614794e066a5738694dc8ef8
22SHA1 (patch-php.ini-production) = 47c1b14ee78fbcaa084a58d2c0c3e843104072be 23SHA1 (patch-php.ini-production) = 47c1b14ee78fbcaa084a58d2c0c3e843104072be
23SHA1 (patch-run-tests.php) = ff80b8ad52d7c0a43fa318ed9bffca9d7b3e688d 24SHA1 (patch-run-tests.php) = ff80b8ad52d7c0a43fa318ed9bffca9d7b3e688d
File Added: pkgsrc/lang/php55/patches/Attic/patch-ext_gd_libgd_gdxpm.c
$NetBSD: patch-ext_gd_libgd_gdxpm.c,v 1.1 2014/05/11 11:20:47 he Exp $

Patch to fix CVE-2014-2497, taken from
https://bugs.php.net/patch-display.php?bug_id=66901

--- ext/gd/libgd/gdxpm.c.orig	2014-04-29 08:04:30.000000000 +0000
+++ ext/gd/libgd/gdxpm.c
@@ -39,6 +39,13 @@ gdImagePtr gdImageCreateFromXpm (char *f
 	number = image.ncolors;
 	colors = (int *) safe_emalloc(number, sizeof(int), 0);
 	for (i = 0; i < number; i++) {
+		if (!image.colorTable[i].c_color)
+		{
+			/* unsupported color key or color key not defined */
+			gdImageDestroy(im);
+			im = 0;
+			goto done;
+		}
 		switch (strlen (image.colorTable[i].c_color)) {
 			case 4:
 				buf[1] = '\0';
@@ -125,8 +132,8 @@ gdImagePtr gdImageCreateFromXpm (char *f
 		}
 	}
 
-	gdFree(colors);
  done:
+	gdFree(colors);
 	XpmFreeXpmImage(&image);
 	XpmFreeXpmInfo(&info);
 	return im;