php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source
This commit is contained in:
David Carlier
2025-03-28 17:31:50 +00:00
parent 6ff9ca12d6 3a5c87f964
commit 18102ec708
2 changed files with 65 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
ext/gd/gd.c
View File

@@ -3867,6 +3867,26 @@ PHP_FUNCTION(imagecrop)
RETURN_THROWS();
}
if ((rect.width > 0 && rect.x > INT_MAX - rect.width)) {
zend_argument_value_error(2, "overflow with \"x\" and \"width\" keys");
RETURN_THROWS();
}
if ((rect.width < 0 && rect.x < INT_MIN - rect.width)) {
zend_argument_value_error(2, "underflow with \"x\" and \"width\" keys");
RETURN_THROWS();
}
if ((rect.height > 0 && rect.y > INT_MAX - rect.height)) {
zend_argument_value_error(2, "overflow with \"y\" and \"height\" keys");
RETURN_THROWS();
}
if ((rect.height < 0 && rect.y < INT_MIN - rect.height)) {
zend_argument_value_error(2, "underflow with \"y\" and \"height\" keys");
RETURN_THROWS();
}
im_crop = gdImageCrop(im, &rect);
if (im_crop == NULL) {

45
ext/gd/tests/imagecrop_overflow.phpt Normal file
View File

@@ -0,0 +1,45 @@
--TEST--
imagecrop() overflows when the combo x/width or y/height is over INT_MAX or under INT_MIN.
--EXTENSIONS--
gd
--FILE--
<?php
$img = imagecreatetruecolor(10, 10);
$arr = ["x" => 2147483647, "y" => 2147483647, "width" => 10, "height" => 10];
try {
imagecrop($img, $arr);
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
$arr = ["x" => -2147483648, "y" => 0, "width" => -10, "height" => 10];
try {
imagecrop($img, $arr);
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
$arr = ["x" => 1, "y" => 2147483647, "width" => 10, "height" => 10];
try {
imagecrop($img, $arr);
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
$arr = ["x" => 1, "y" => -2147483648, "width" => 10, "height" => -10];
try {
imagecrop($img, $arr);
} catch (\ValueError $e) {
echo $e->getMessage();
}
?>
--EXPECT--
imagecrop(): Argument #2 ($rectangle) overflow with "x" and "width" keys
imagecrop(): Argument #2 ($rectangle) underflow with "x" and "width" keys
imagecrop(): Argument #2 ($rectangle) overflow with "y" and "height" keys
imagecrop(): Argument #2 ($rectangle) underflow with "y" and "height" keys