php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source
This commit is contained in:
David Carlier
2024-10-11 19:38:26 +01:00
parent 89b4f94024 f2859a4050
commit d612b0a124
3 changed files with 44 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -17,6 +17,10 @@ PHP NEWS
. Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
(nielsdos)
- GD:
. Fixed bug GH-16334 (imageaffine overflow on matrix elements).
(David Carlier)
- MBstring:
. Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
(David Carlier)

14
ext/gd/gd.c
View File

@@ -3683,13 +3683,25 @@ PHP_FUNCTION(imageaffine)
if ((zval_affine_elem = zend_hash_index_find(Z_ARRVAL_P(z_affine), i)) != NULL) {
switch (Z_TYPE_P(zval_affine_elem)) {
case IS_LONG:
affine[i] = Z_LVAL_P(zval_affine_elem);
affine[i] = Z_LVAL_P(zval_affine_elem);
if (affine[i] < INT_MIN || affine[i] > INT_MAX) {
zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX);
RETURN_THROWS();
}
break;
case IS_DOUBLE:
affine[i] = Z_DVAL_P(zval_affine_elem);
if (affine[i] < INT_MIN || affine[i] > INT_MAX) {
zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX);
RETURN_THROWS();
}
break;
case IS_STRING:
affine[i] = zval_get_double(zval_affine_elem);
if (affine[i] < INT_MIN || affine[i] > INT_MAX) {
zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX);
RETURN_THROWS();
}
break;
default:
zend_argument_type_error(3, "contains invalid type for element %i", i);

27
ext/gd/tests/gh16322.phpt Normal file
View File

@@ -0,0 +1,27 @@
--TEST--
GH-16322 (imageaffine overflow/underflow on affine matrix)
--EXTENSIONS--
gd
--INI--
memory_limit=-1
--FILE--
<?php
$matrix = [INF, 1, 1, 1, 1, 1];
$src = imagecreatetruecolor(8, 8);
try {
imageaffine($src, $matrix);
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
$matrix[0] = 1;
$matrix[3] = -INF;
try {
imageaffine($src, $matrix);
} catch (\ValueError $e) {
echo $e->getMessage();
}
?>
--EXPECTF--
imageaffine(): Argument #2 ($affine) element 0 must be between %s and %d
imageaffine(): Argument #2 ($affine) element 3 must be between %s and %d