Is it a same origin policy violation to manipulate image data you retrieved from another site using PHP and cURL?
Provided the PHP script you use is in the same domain... If you retrieve an object from a remote server and deliver it down to a client connected to your server, from the client's perspective it does indeed come from your server, hence it is not a same-origin violation. This is true whether you retrieve it with cURL and immediately dump it down to the client browser, or if you hang onto it in memory, modify it, and then dump it down to the browser.