php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4' into PHP-8.5

Browse Source 
* PHP-8.4:
  Fix GH-20602: imagescale() overflow with large height values.
This commit is contained in:
David Carlier
2025-11-29 13:32:18 +00:00
parent 1279bc60e7 6d5490861f
commit 848269d6a8
2 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ext/gd/gd.c
View File

@@ -3931,9 +3931,17 @@ PHP_FUNCTION(imagescale)
src_y = gdImageSY(im);
if (src_x && tmp_h < 0) {
if (tmp_w > (ZEND_LONG_MAX / src_y)) {
zend_argument_value_error(2, "must be less than or equal to " ZEND_LONG_FMT, (zend_long)(ZEND_LONG_MAX / src_y));
RETURN_THROWS();
}
tmp_h = tmp_w * src_y / src_x;
}
if (src_y && tmp_w < 0) {
if (tmp_h > (ZEND_LONG_MAX / src_x)) {
zend_argument_value_error(3, "must be less than or equal to " ZEND_LONG_FMT, (zend_long)(ZEND_LONG_MAX / src_x));
RETURN_THROWS();
}
tmp_w = tmp_h * src_x / src_y;
}
}

22
ext/gd/tests/gh20602.phpt Normal file
View File

@@ -0,0 +1,22 @@
--TEST--
GH-20551: (imagegammacorrect out of range input/output value)
--EXTENSIONS--
gd
--FILE--
<?php
$im = imagecreatetruecolor(16, 16);
try {
imagescale($im, PHP_INT_MAX, -1);
} catch (\ValueError $e) {
echo $e->getMessage(), PHP_EOL;
}
try {
imagescale($im, -1, PHP_INT_MAX);
} catch (\ValueError $e) {
echo $e->getMessage(), PHP_EOL;
}
?>
--EXPECTF--
imagescale(): Argument #2 ($width) must be less than or equal to %d
imagescale(): Argument #3 ($height) must be less than or equal to %d