php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-16255: Unexpected nan value in ext/gd/libgd/gd_filter.c

Browse Source 
Closes GH-17169.
This commit is contained in:
Niels Dossche
2024-12-15 20:09:06 +01:00
parent 2df9f32732
commit 6c198e380e
3 changed files with 56 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -17,6 +17,10 @@ PHP NEWS
. Fixed bug GH-13437 (FPM: ERROR: scoreboard: failed to lock (already
locked)). (Jakub Zelenka)
- GD:
. Fixed bug GH-16255 (Unexpected nan value in ext/gd/libgd/gd_filter.c).
(nielsdos, cmb)
- Iconv:
. Fixed bug GH-17047 (UAF on iconv filter failure). (nielsdos)

19
ext/gd/gd.c
View File

@@ -3433,7 +3433,24 @@ PHP_FUNCTION(imageconvolution)
}
}
}
res = gdImageConvolution(im_src, matrix, (float)div, (float)offset);
if (UNEXPECTED(!zend_finite(div))) {
zend_argument_value_error(3, "must be finite");
RETURN_THROWS();
}
float div_float = (float) div;
if (UNEXPECTED(div_float == 0.0f)) {
zend_argument_value_error(3, "must not be 0");
RETURN_THROWS();
}
if (UNEXPECTED(!zend_finite(offset))) {
zend_argument_value_error(4, "must be finite");
RETURN_THROWS();
}
res = gdImageConvolution(im_src, matrix, div_float, (float) offset);
if (res) {
RETURN_TRUE;

34
ext/gd/tests/gh16255.phpt Normal file
View File

@@ -0,0 +1,34 @@
--TEST--
GH-16255 (Unexpected nan value in ext/gd/libgd/gd_filter.c)
--EXTENSIONS--
gd
--CREDITS--
cmb69
--FILE--
<?php
$matrix = array(array(1, 0, 1), array(0, 5, 0), array(1, 0, 1));
$im = imagecreatetruecolor(40, 40);
try {
imageconvolution($im, $matrix, NAN, 1.0);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
imageconvolution($im, $matrix, 2.225E-307, 1.0);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
imageconvolution($im, $matrix, 1, NAN);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
imageconvolution(): Argument #3 ($divisor) must be finite
imageconvolution(): Argument #3 ($divisor) must not be 0
imageconvolution(): Argument #4 ($offset) must be finite