archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-19 08:49:28 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge branch 'PHP-7.3'

Browse source 
* PHP-7.3:
  Fix #77272: imagescale() may return image resource on failure
This commit is contained in:
Christoph M. Becker 2019-01-10 14:25:53 +01:00
commit 50ba0149d9
2 changed files with 38 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

43
ext/gd/libgd/gd_interpolation.c
View file

@ -1020,7 +1020,7 @@ static inline void _gdScaleRow(gdImagePtr pSrc, unsigned int src_width, gdImage
} }
} }
static inline void _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigned int src_height, gdImagePtr pDst, unsigned int dst_width, unsigned int dst_height) static inline int _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigned int src_height, gdImagePtr pDst, unsigned int dst_width, unsigned int dst_height)
{ {
unsigned int u; unsigned int u;
LineContribType * contrib; LineContribType * contrib;
@ -1035,13 +1035,14 @@ static inline void _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsign
contrib = _gdContributionsCalc(dst_width, src_width, (double)dst_width / (double)src_width, pSrc->interpolation); contrib = _gdContributionsCalc(dst_width, src_width, (double)dst_width / (double)src_width, pSrc->interpolation);
if (contrib == NULL) { if (contrib == NULL) {
return; return 0;
} }
/* Scale each row */ /* Scale each row */
for (u = 0; u < dst_height - 1; u++) { for (u = 0; u < dst_height - 1; u++) {
_gdScaleRow(pSrc, src_width, pDst, dst_width, u, contrib); _gdScaleRow(pSrc, src_width, pDst, dst_width, u, contrib);
} }
_gdContributionsFree (contrib); _gdContributionsFree (contrib);
return 1;
} }
static inline void _gdScaleCol (gdImagePtr pSrc, unsigned int src_width, gdImagePtr pRes, unsigned int dst_width, unsigned int dst_height, unsigned int uCol, LineContribType *contrib) static inline void _gdScaleCol (gdImagePtr pSrc, unsigned int src_width, gdImagePtr pRes, unsigned int dst_width, unsigned int dst_height, unsigned int uCol, LineContribType *contrib)
@ -1066,7 +1067,7 @@ static inline void _gdScaleCol (gdImagePtr pSrc, unsigned int src_width, gdImag
} }
} }
static inline void _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height) static inline int _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height)
{ {
unsigned int u; unsigned int u;
LineContribType * contrib; LineContribType * contrib;
@ -1081,19 +1082,21 @@ static inline void _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_w
contrib = _gdContributionsCalc(dst_height, src_height, (double)(dst_height) / (double)(src_height), pSrc->interpolation); contrib = _gdContributionsCalc(dst_height, src_height, (double)(dst_height) / (double)(src_height), pSrc->interpolation);
if (contrib == NULL) { if (contrib == NULL) {
return; return 0;
} }
/* scale each column */ /* scale each column */
for (u = 0; u < dst_width - 1; u++) { for (u = 0; u < dst_width - 1; u++) {
_gdScaleCol(pSrc, src_width, pDst, dst_width, dst_height, u, contrib); _gdScaleCol(pSrc, src_width, pDst, dst_width, dst_height, u, contrib);
} }
_gdContributionsFree(contrib); _gdContributionsFree(contrib);
return 1;
} }
gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const unsigned int new_width, const unsigned int new_height) gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const unsigned int new_width, const unsigned int new_height)
{ {
gdImagePtr tmp_im; gdImagePtr tmp_im;
gdImagePtr dst; gdImagePtr dst;
int scale_pass_res;
if (new_width == 0 || new_height == 0) { if (new_width == 0 || new_height == 0) {
return NULL; return NULL;
@ -1109,7 +1112,11 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
return NULL; return NULL;
} }
gdImageSetInterpolationMethod(tmp_im, src->interpolation_id); gdImageSetInterpolationMethod(tmp_im, src->interpolation_id);
_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height); scale_pass_res = _gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
if (scale_pass_res != 1) {
gdImageDestroy(tmp_im);
return NULL;
}
dst = gdImageCreateTrueColor(new_width, new_height); dst = gdImageCreateTrueColor(new_width, new_height);
if (dst == NULL) { if (dst == NULL) {
@ -1117,30 +1124,14 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
return NULL; return NULL;
} }
gdImageSetInterpolationMethod(dst, src->interpolation_id); gdImageSetInterpolationMethod(dst, src->interpolation_id);
_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height); scale_pass_res = _gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
gdImageDestroy(tmp_im); if (scale_pass_res != 1) {
gdImageDestroy(dst);
return dst; gdImageDestroy(tmp_im);
}
gdImagePtr Scale(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const gdImagePtr dst, const unsigned int new_width, const unsigned int new_height)
{
gdImagePtr tmp_im;
if (new_width == 0 || new_height == 0) {
return NULL; return NULL;
} }
tmp_im = gdImageCreateTrueColor(new_width, src_height);
if (tmp_im == NULL) {
return NULL;
}
gdImageSetInterpolationMethod(tmp_im, src->interpolation_id);
_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
gdImageDestroy(tmp_im); gdImageDestroy(tmp_im);
return dst; return dst;
} }

21
ext/gd/tests/bug77272.phpt Normal file
View file

@ -0,0 +1,21 @@
--TEST--
Bug #77272 (imagescale() may return image resource on failure)
--INI--
memory_limit=-1
--SKIPIF--
<?php
if (!extension_loaded('gd')) die('skip gd extension not available');
if (!GD_BUNGLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream fix not yet released');
if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
?>
--FILE--
<?php
$img = imagecreate(2**28, 1);
var_dump(imagescale($img, 1, 1, IMG_TRIANGLE));
?>
===DONE===
--EXPECTF--
Warning: imagescale():%S product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
in %s on line %d
bool(false)
===DONE===