php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3' into PHP-8.4

Browse Source 
* PHP-8.3:
  Fix GH-20622: imagestring/imagestringup overflow/underflow.
This commit is contained in:
David Carlier
2025-12-04 23:14:01 +00:00
parent 175548e868 9f654decdc
commit 2c2852ae8e
3 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -2,6 +2,9 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.4.17
- GD:
. Fixed bug GH-20622 (imagestring/imagestringup overflow). (David Carlier)
18 Dec 2025, PHP 8.4.16

9
ext/gd/gd.c
View File

@@ -3023,7 +3023,8 @@ static void php_imagechar(INTERNAL_FUNCTION_PARAMETERS, int mode)
zend_long X, Y, COL;
zend_string *C;
gdImagePtr im;
int ch = 0, col, x, y, i, l = 0;
int ch = 0, col, i, l = 0;
unsigned int x, y;
unsigned char *str = NULL;
zend_object *font_obj = NULL;
zend_long font_int = 0;
@@ -3055,21 +3056,21 @@ static void php_imagechar(INTERNAL_FUNCTION_PARAMETERS, int mode)
switch (mode) {
case 0:
gdImageChar(im, font, x, y, ch, col);
gdImageChar(im, font, (int)x, (int)y, ch, col);
break;
case 1:
php_gdimagecharup(im, font, x, y, ch, col);
break;
case 2:
for (i = 0; (i < l); i++) {
gdImageChar(im, font, x, y, (int) ((unsigned char) str[i]), col);
gdImageChar(im, font, (int)x, (int)y, (int) ((unsigned char) str[i]), col);
x += font->w;
}
break;
case 3: {
for (i = 0; (i < l); i++) {
/* php_gdimagecharup(im, font, x, y, (int) str[i], col); */
gdImageCharUp(im, font, x, y, (int) str[i], col);
gdImageCharUp(im, font, (int)x, (int)y, (int) str[i], col);
y -= font->w;
}
break;

13
ext/gd/tests/gh20622.phpt Normal file
View File

@@ -0,0 +1,13 @@
--TEST--
GH-20622 (imagestring/imagestringup overflow/underflow)
--EXTENSIONS--
gd
--FILE--
<?php
$im = imagecreate(64, 64);
imagestringup($im, 5, 0, -2147483648, 'STRINGUP', 0);
imagestring($im, 5, -2147483648, 0, 'STRING', 0);
echo "OK";
?>
--EXPECT--
OK