diff --git a/NEWS b/NEWS index e6e36301a88..06d72ede699 100644 --- a/NEWS +++ b/NEWS @@ -19,6 +19,10 @@ PHP NEWS . Fixed bug GH-16316 (DOMXPath breaks when not initialized properly). (nielsdos) +- GD: + . Fixed bug GH-16334 (imageaffine overflow on matrix elements). + (David Carlier) + - MBstring: . Fixed bug GH-16361 (mb_substr overflow on start/length arguments). (David Carlier) diff --git a/ext/gd/gd.c b/ext/gd/gd.c index a93e15c6baa..a2c3e7d0de6 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -4042,13 +4042,25 @@ PHP_FUNCTION(imageaffine) if ((zval_affine_elem = zend_hash_index_find(Z_ARRVAL_P(z_affine), i)) != NULL) { switch (Z_TYPE_P(zval_affine_elem)) { case IS_LONG: - affine[i] = Z_LVAL_P(zval_affine_elem); + affine[i] = Z_LVAL_P(zval_affine_elem); + if (affine[i] < INT_MIN || affine[i] > INT_MAX) { + zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX); + RETURN_THROWS(); + } break; case IS_DOUBLE: affine[i] = Z_DVAL_P(zval_affine_elem); + if (affine[i] < INT_MIN || affine[i] > INT_MAX) { + zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX); + RETURN_THROWS(); + } break; case IS_STRING: affine[i] = zval_get_double(zval_affine_elem); + if (affine[i] < INT_MIN || affine[i] > INT_MAX) { + zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX); + RETURN_THROWS(); + } break; default: zend_argument_type_error(3, "contains invalid type for element %i", i); diff --git a/ext/gd/tests/gh16322.phpt b/ext/gd/tests/gh16322.phpt new file mode 100644 index 00000000000..1edc27285d2 --- /dev/null +++ b/ext/gd/tests/gh16322.phpt @@ -0,0 +1,27 @@ +--TEST-- +GH-16322 (imageaffine overflow/underflow on affine matrix) +--EXTENSIONS-- +gd +--INI-- +memory_limit=-1 +--FILE-- +getMessage() . PHP_EOL; +} +$matrix[0] = 1; +$matrix[3] = -INF; +try { + imageaffine($src, $matrix); +} catch (\ValueError $e) { + echo $e->getMessage(); +} +?> +--EXPECTF-- +imageaffine(): Argument #2 ($affine) element 0 must be between %s and %d +imageaffine(): Argument #2 ($affine) element 3 must be between %s and %d