php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-17984: gd calls with array arguments.

Browse Source 
close GH-17985
This commit is contained in:
David Carlier
2025-03-06 22:26:34 +00:00
parent 5942a611e4
commit 07ceadf7d9
3 changed files with 50 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -34,6 +34,8 @@ PHP NEWS
- GD: - GD:
. Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M). . Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M).
(David Carlier) (David Carlier)
. Fixed bug GH-17984 (calls with arguments as array with references).
(David Carlier)
- LDAP: - LDAP:
. Fixed bug GH-17704 (ldap_search fails when $attributes contains a . Fixed bug GH-17704 (ldap_search fails when $attributes contains a

8
ext/gd/gd.c
View File

@@ -3417,7 +3417,7 @@ PHP_FUNCTION(imageconvolution)
} }
for (i=0; i<3; i++) { for (i=0; i<3; i++) {
if ((var = zend_hash_index_find(Z_ARRVAL_P(hash_matrix), (i))) != NULL && Z_TYPE_P(var) == IS_ARRAY) { if ((var = zend_hash_index_find_deref(Z_ARRVAL_P(hash_matrix), (i))) != NULL && Z_TYPE_P(var) == IS_ARRAY) {
if (zend_hash_num_elements(Z_ARRVAL_P(var)) != 3 ) { if (zend_hash_num_elements(Z_ARRVAL_P(var)) != 3 ) {
zend_argument_value_error(2, "must be a 3x3 array, matrix[%d] only has %d elements", i, zend_hash_num_elements(Z_ARRVAL_P(var))); zend_argument_value_error(2, "must be a 3x3 array, matrix[%d] only has %d elements", i, zend_hash_num_elements(Z_ARRVAL_P(var)));
RETURN_THROWS(); RETURN_THROWS();
@@ -3697,7 +3697,7 @@ PHP_FUNCTION(imageaffine)
} }
for (i = 0; i < nelems; i++) { for (i = 0; i < nelems; i++) {
if ((zval_affine_elem = zend_hash_index_find(Z_ARRVAL_P(z_affine), i)) != NULL) { if ((zval_affine_elem = zend_hash_index_find_deref(Z_ARRVAL_P(z_affine), i)) != NULL) {
switch (Z_TYPE_P(zval_affine_elem)) { switch (Z_TYPE_P(zval_affine_elem)) {
case IS_LONG: case IS_LONG:
affine[i] = Z_LVAL_P(zval_affine_elem); affine[i] = Z_LVAL_P(zval_affine_elem);
@@ -3873,7 +3873,7 @@ PHP_FUNCTION(imageaffinematrixconcat)
} }
for (i = 0; i < 6; i++) { for (i = 0; i < 6; i++) {
if ((tmp = zend_hash_index_find(Z_ARRVAL_P(z_m1), i)) != NULL) { if ((tmp = zend_hash_index_find_deref(Z_ARRVAL_P(z_m1), i)) != NULL) {
switch (Z_TYPE_P(tmp)) { switch (Z_TYPE_P(tmp)) {
case IS_LONG: case IS_LONG:
m1[i] = Z_LVAL_P(tmp); m1[i] = Z_LVAL_P(tmp);
@@ -3890,7 +3890,7 @@ PHP_FUNCTION(imageaffinematrixconcat)
} }
} }
if ((tmp = zend_hash_index_find(Z_ARRVAL_P(z_m2), i)) != NULL) { if ((tmp = zend_hash_index_find_deref(Z_ARRVAL_P(z_m2), i)) != NULL) {
switch (Z_TYPE_P(tmp)) { switch (Z_TYPE_P(tmp)) {
case IS_LONG: case IS_LONG:
m2[i] = Z_LVAL_P(tmp); m2[i] = Z_LVAL_P(tmp);

44
ext/gd/tests/gh17984.phpt Normal file
View File

@@ -0,0 +1,44 @@
--TEST--
GH-17984: array of references handling
--EXTENSIONS--
gd
--FILE--
<?php
$a = 45;
$matrix = [&$a, 1, 3, 1, 5, 1];
$subarray = [&$a, 0, 0];
$matrix3 = array([0, 0, 0] , &$subarray, [0, 0, 0]);
$src = imagecreatetruecolor(8, 8);
var_dump(imageaffine($src, $matrix));
var_dump(imageaffinematrixconcat($matrix, $matrix));
var_dump(imageconvolution($src, $matrix3, 1.0, 0.0));
$poly = imagecolorallocate($src, 255, 0, 0);
var_dump(imagepolygon($src, array (
&$a, 0,
100, 200,
300, 200
),
$poly));
$style = [&$a, &$a];
var_dump(imagesetstyle($src, $style));
?>
--EXPECT--
object(GdImage)#2 (0) {
}
array(6) {
[0]=>
float(2028)
[1]=>
float(46)
[2]=>
float(138)
[3]=>
float(4)
[4]=>
float(233)
[5]=>
float(7)
}
bool(true)
bool(true)
bool(true)