This bug was first reported to php on https://bugs.php.net/bug.php?id=73968.
php then reported it to gd in https://github.com/libgd/libgd/issues/109. This
patch is taken from commit:
https://github.com/libgd/libgd/commit/082c5444838ea0d84f9fb6441aefdb44d78d9bba

Binary files have been removed from the patch because our patch procedure
doesn't support that format.

From 082c5444838ea0d84f9fb6441aefdb44d78d9bba Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Fri, 20 Jan 2017 22:48:20 +0100
Subject: [PATCH] Fix #109: XBM reading fails with printed error

When calculating the number of required bytes of an XBM image, we have
to take the line padding into account.
---
 src/gd_xbm.c                     |   2 +-
 tests/xbm/CMakeLists.txt         |   1 +
 tests/xbm/Makemodule.am          |   5 ++++-
 tests/xbm/github_bug_109.c       |  35 +++++++++++++++++++++++++++++++++++
 tests/xbm/github_bug_109.xbm     |   5 +++++
 5 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 tests/xbm/github_bug_109.c
 create mode 100644 tests/xbm/github_bug_109.xbm
 create mode 100644 tests/xbm/github_bug_109_exp.png

diff --git a/src/gd_xbm.c b/src/gd_xbm.c
index 5f09b56..c2ba2ad 100644
--- a/src/gd_xbm.c
+++ b/src/gd_xbm.c
@@ -108,7 +108,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromXbm(FILE * fd)
 				max_bit = 32768;
 			}
 			if (max_bit) {
-				bytes = (width * height / 8) + 1;
+                bytes = (width + 7) / 8 * height;
 				if (!bytes) {
 					return 0;
 				}
diff --git a/tests/xbm/CMakeLists.txt b/tests/xbm/CMakeLists.txt
index 183cf5e..08576e0 100644
--- a/tests/xbm/CMakeLists.txt
+++ b/tests/xbm/CMakeLists.txt
@@ -1,4 +1,5 @@
 LIST(APPEND TESTS_FILES
+	github_bug_109
 	github_bug_170
 )
 
diff --git a/tests/xbm/Makemodule.am b/tests/xbm/Makemodule.am
index ba1eabd..0f5beb6 100644
--- a/tests/xbm/Makemodule.am
+++ b/tests/xbm/Makemodule.am
@@ -1,5 +1,8 @@
 libgd_test_programs += \
+	xbm/github_bug_109 \
 	xbm/github_bug_170
 
 EXTRA_DIST += \
-	xbm/CMakeLists.txt
+	xbm/CMakeLists.txt \
+	xbm/github_bug_109.xbm \
+	xbm/github_bug_109_exp.png
diff --git a/tests/xbm/github_bug_109.c b/tests/xbm/github_bug_109.c
new file mode 100644
index 0000000..1a020c6
--- /dev/null
+++ b/tests/xbm/github_bug_109.c
@@ -0,0 +1,35 @@
+/**
+ * Test reading of XBM images with a width that is not a multiple of 8
+ *
+ * We're reading such an XBM image, and check that we got what we've expected,
+ * instead of an error message.
+ *
+ * See also <https://github.com/libgd/libgd/issues/109>.
+ */
+
+
+#include "gd.h"
+#include "gdtest.h"
+
+
+int main()
+{
+    gdImagePtr im;
+    FILE *fp;
+    char *path;
+
+    fp = gdTestFileOpen2("xbm", "github_bug_109.xbm");
+    im = gdImageCreateFromXbm(fp);
+    fclose(fp);
+    gdTestAssert(im != NULL);
+    gdTestAssert(gdImageGetTrueColorPixel(im, 0, 0) == 0);
+    gdTestAssert(gdImageGetTrueColorPixel(im, 0, 1) == 0xffffff);
+
+    path = gdTestFilePath2("xbm", "github_bug_109_exp.png");
+    gdAssertImageEqualsToFile(path, im);
+    gdFree(path);
+
+    gdImageDestroy(im);
+
+    return gdNumFailures();
+}
diff --git a/tests/xbm/github_bug_109.xbm b/tests/xbm/github_bug_109.xbm
new file mode 100644
index 0000000..f427d86
--- /dev/null
+++ b/tests/xbm/github_bug_109.xbm
@@ -0,0 +1,5 @@
+#define test_width 10
+#define test_height 10
+static unsigned char test_bits[] = {
+  0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00, 
+  0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00};

-- 
2.7.4