php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 08:12:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source
This commit is contained in:
David Carlier
2024-10-11 19:38:58 +01:00
parent b14076a4e6 be370edbd7
commit 2b39e72fac
2 changed files with 40 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
ext/gd/gd.c
View File

@@ -4042,13 +4042,25 @@ PHP_FUNCTION(imageaffine)
if ((zval_affine_elem = zend_hash_index_find(Z_ARRVAL_P(z_affine), i)) != NULL) {
switch (Z_TYPE_P(zval_affine_elem)) {
case IS_LONG:
affine[i] = Z_LVAL_P(zval_affine_elem);
affine[i] = Z_LVAL_P(zval_affine_elem);
if (affine[i] < INT_MIN || affine[i] > INT_MAX) {
zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX);
RETURN_THROWS();
}
break;
case IS_DOUBLE:
affine[i] = Z_DVAL_P(zval_affine_elem);
if (affine[i] < INT_MIN || affine[i] > INT_MAX) {
zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX);
RETURN_THROWS();
}
break;
case IS_STRING:
affine[i] = zval_get_double(zval_affine_elem);
if (affine[i] < INT_MIN || affine[i] > INT_MAX) {
zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX);
RETURN_THROWS();
}
break;
default:
zend_argument_type_error(3, "contains invalid type for element %i", i);

27
ext/gd/tests/gh16322.phpt Normal file
View File

@@ -0,0 +1,27 @@
--TEST--
GH-16322 (imageaffine overflow/underflow on affine matrix)
--EXTENSIONS--
gd
--INI--
memory_limit=-1
--FILE--
<?php
$matrix = [INF, 1, 1, 1, 1, 1];
$src = imagecreatetruecolor(8, 8);
try {
imageaffine($src, $matrix);
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
$matrix[0] = 1;
$matrix[3] = -INF;
try {
imageaffine($src, $matrix);
} catch (\ValueError $e) {
echo $e->getMessage();
}
?>
--EXPECTF--
imageaffine(): Argument #2 ($affine) element 0 must be between %s and %d
imageaffine(): Argument #2 ($affine) element 3 must be between %s and %d