archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 14:08:47 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.3' into PHP-8.4

Browse source
This commit is contained in:
David Carlier 2024-10-11 19:38:39 +01:00
commit be370edbd7
No known key found for this signature in database
GPG key ID: 8486F847B4B94EF1
3 changed files with 44 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
NEWS
View file

@ -19,6 +19,10 @@ PHP NEWS
. Fixed bug GH-16316 (DOMXPath breaks when not initialized properly). . Fixed bug GH-16316 (DOMXPath breaks when not initialized properly).
(nielsdos) (nielsdos)
- GD:
. Fixed bug GH-16334 (imageaffine overflow on matrix elements).
(David Carlier)
- MBstring: - MBstring:
. Fixed bug GH-16361 (mb_substr overflow on start/length arguments). . Fixed bug GH-16361 (mb_substr overflow on start/length arguments).
(David Carlier) (David Carlier)

12
ext/gd/gd.c
View file

@ -4043,12 +4043,24 @@ PHP_FUNCTION(imageaffine)
switch (Z_TYPE_P(zval_affine_elem)) { switch (Z_TYPE_P(zval_affine_elem)) {
case IS_LONG: case IS_LONG:
affine[i] = Z_LVAL_P(zval_affine_elem); affine[i] = Z_LVAL_P(zval_affine_elem);
if (affine[i] < INT_MIN || affine[i] > INT_MAX) {
zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX);
RETURN_THROWS();
}
break; break;
case IS_DOUBLE: case IS_DOUBLE:
affine[i] = Z_DVAL_P(zval_affine_elem); affine[i] = Z_DVAL_P(zval_affine_elem);
if (affine[i] < INT_MIN || affine[i] > INT_MAX) {
zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX);
RETURN_THROWS();
}
break; break;
case IS_STRING: case IS_STRING:
affine[i] = zval_get_double(zval_affine_elem); affine[i] = zval_get_double(zval_affine_elem);
if (affine[i] < INT_MIN || affine[i] > INT_MAX) {
zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX);
RETURN_THROWS();
}
break; break;
default: default:
zend_argument_type_error(3, "contains invalid type for element %i", i); zend_argument_type_error(3, "contains invalid type for element %i", i);

27
ext/gd/tests/gh16322.phpt Normal file
View file

@ -0,0 +1,27 @@
--TEST--
GH-16322 (imageaffine overflow/underflow on affine matrix)
--EXTENSIONS--
gd
--INI--
memory_limit=-1
--FILE--
<?php
$matrix = [INF, 1, 1, 1, 1, 1];
$src = imagecreatetruecolor(8, 8);
try {
imageaffine($src, $matrix);
} catch (\ValueError $e) {
echo $e->getMessage() . PHP_EOL;
}
$matrix[0] = 1;
$matrix[3] = -INF;
try {
imageaffine($src, $matrix);
} catch (\ValueError $e) {
echo $e->getMessage();
}
?>
--EXPECTF--
imageaffine(): Argument #2 ($affine) element 0 must be between %s and %d
imageaffine(): Argument #2 ($affine) element 3 must be between %s and %d