1
0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00

ext/gd: iamgeresolution checks overflow. (#14585)

This commit is contained in:
David CARLIER
2024-06-16 23:28:04 +01:00
committed by GitHub
parent a888c4f0ff
commit 1fc083e526
2 changed files with 50 additions and 0 deletions

View File

@@ -4282,12 +4282,28 @@ PHP_FUNCTION(imageresolution)
im = php_gd_libgdimageptr_from_zval_p(IM);
if (!res_x_is_null && !res_y_is_null) {
if (res_x < 0 || ZEND_SIZE_T_UINT_OVFL(res_x)) {
zend_argument_value_error(2, "must be between 0 and %u", UINT_MAX);
RETURN_THROWS();
}
if (res_y < 0 || ZEND_SIZE_T_UINT_OVFL(res_y)) {
zend_argument_value_error(3, "must be between 0 and %u", UINT_MAX);
RETURN_THROWS();
}
gdImageSetResolution(im, res_x, res_y);
RETURN_TRUE;
} else if (!res_x_is_null && res_y_is_null) {
if (res_x < 0 || ZEND_SIZE_T_UINT_OVFL(res_x)) {
zend_argument_value_error(2, "must be between 0 and %u", UINT_MAX);
RETURN_THROWS();
}
gdImageSetResolution(im, res_x, res_x);
RETURN_TRUE;
} else if (res_x_is_null && !res_y_is_null) {
if (res_y < 0 || ZEND_SIZE_T_UINT_OVFL(res_y)) {
zend_argument_value_error(3, "must be between 0 and %u", UINT_MAX);
RETURN_THROWS();
}
gdImageSetResolution(im, res_y, res_y);
RETURN_TRUE;
}

View File

@@ -0,0 +1,34 @@
--TEST--
Wrong image resolution
--EXTENSIONS--
gd
--SKIPIF--
<?php
if (PHP_INT_SIZE != 8) die("skip on non 64 bits architectures");
?>
--FILE--
<?php
$filename = __DIR__ . DIRECTORY_SEPARATOR . 'imageresolution_png.png';
$exp = imagecreate(100, 100);
imagecolorallocate($exp, 255, 127, 64);
$res = imageresolution($exp);
try {
imageresolution($exp, PHP_INT_MAX);
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
try {
imageresolution($exp, 127, -PHP_INT_MAX);
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
imageresolution($exp, 0, 0);
var_dump(imageresolution($exp) == $res);
?>
--EXPECTF--
imageresolution(): Argument #2 ($resolution_x) must be between 0 and %d
imageresolution(): Argument #3 ($resolution_y) must be between 0 and %d
bool(true)