This bug was first reported to php on https://bugs.php.net/bug.php?id=73968.
php then reported it to gd in https://github.com/libgd/libgd/issues/109. This
patch is taken from commit 082c5444838ea0d84f9fb6441aefdb44d78d9bba of gd.
Binary files have been removed from the patch because our patch procedure
doesn't support that format.

From 082c5444838ea0d84f9fb6441aefdb44d78d9bba Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Fri, 20 Jan 2017 22:48:20 +0100
Subject: [PATCH] Fix #109: XBM reading fails with printed error

When calculating the number of required bytes of an XBM image, we have
to take the line padding into account.
---
 src/gd_xbm.c                     |   2 +-
 tests/xbm/CMakeLists.txt         |   1 +
 tests/xbm/Makemodule.am          |   5 ++++-
 tests/xbm/github_bug_109.c       |  35 +++++++++++++++++++++++++++++++++++
 tests/xbm/github_bug_109.xbm     |   5 +++++
 5 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 tests/xbm/github_bug_109.c
 create mode 100644 tests/xbm/github_bug_109.xbm
 create mode 100644 tests/xbm/github_bug_109_exp.png

diff --git a/src/gd_xbm.c b/src/gd_xbm.c
index 5f09b56..c2ba2ad 100644
--- a/src/gd_xbm.c
+++ b/src/gd_xbm.c
@@ -108,7 +108,7 @@ BGD_DECLARE(gdImagePtr) gdImageCreateFromXbm(FILE * fd)
 				max_bit = 32768;
 			}
 			if (max_bit) {
-				bytes = (width * height / 8) + 1;
+                bytes = (width + 7) / 8 * height;
 				if (!bytes) {
 					return 0;
 				}
diff --git a/tests/xbm/CMakeLists.txt b/tests/xbm/CMakeLists.txt
index 183cf5e..08576e0 100644
--- a/tests/xbm/CMakeLists.txt
+++ b/tests/xbm/CMakeLists.txt
@@ -1,4 +1,5 @@
 LIST(APPEND TESTS_FILES
+	github_bug_109
 	github_bug_170
 )
 
diff --git a/tests/xbm/Makemodule.am b/tests/xbm/Makemodule.am
index ba1eabd..0f5beb6 100644
--- a/tests/xbm/Makemodule.am
+++ b/tests/xbm/Makemodule.am
@@ -1,5 +1,8 @@
 libgd_test_programs += \
+	xbm/github_bug_109 \
 	xbm/github_bug_170
 
 EXTRA_DIST += \
-	xbm/CMakeLists.txt
+	xbm/CMakeLists.txt \
+	xbm/github_bug_109.xbm \
+	xbm/github_bug_109_exp.png
diff --git a/tests/xbm/github_bug_109.c b/tests/xbm/github_bug_109.c
new file mode 100644
index 0000000..1a020c6
--- /dev/null
+++ b/tests/xbm/github_bug_109.c
@@ -0,0 +1,35 @@
+/**
+ * Test reading of XBM images with a width that is not a multiple of 8
+ *
+ * We're reading such an XBM image, and check that we got what we've expected,
+ * instead of an error message.
+ *
+ * See also <https://github.com/libgd/libgd/issues/109>.
+ */
+
+
+#include "gd.h"
+#include "gdtest.h"
+
+
+int main()
+{
+    gdImagePtr im;
+    FILE *fp;
+    char *path;
+
+    fp = gdTestFileOpen2("xbm", "github_bug_109.xbm");
+    im = gdImageCreateFromXbm(fp);
+    fclose(fp);
+    gdTestAssert(im != NULL);
+    gdTestAssert(gdImageGetTrueColorPixel(im, 0, 0) == 0);
+    gdTestAssert(gdImageGetTrueColorPixel(im, 0, 1) == 0xffffff);
+
+    path = gdTestFilePath2("xbm", "github_bug_109_exp.png");
+    gdAssertImageEqualsToFile(path, im);
+    gdFree(path);
+
+    gdImageDestroy(im);
+
+    return gdNumFailures();
+}
diff --git a/tests/xbm/github_bug_109.xbm b/tests/xbm/github_bug_109.xbm
new file mode 100644
index 0000000..f427d86
--- /dev/null
+++ b/tests/xbm/github_bug_109.xbm
@@ -0,0 +1,5 @@
+#define test_width 10
+#define test_height 10
+static unsigned char test_bits[] = {
+  0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00, 
+  0xFF, 0x03, 0x00, 0x00, 0xFF, 0x03, 0x00, 0x00};

-- 
2.7.4