diff --git a/NEWS b/NEWS index 5c1c80189cb..1d3da3086ef 100644 --- a/NEWS +++ b/NEWS @@ -36,8 +36,10 @@ PHP NEWS . Fixed bug GH-15168 (stack overflow in json_encode()). (nielsdos) - GD: - . Fixed bug 16232 (bitshift overflow on wbmp file content reading / + . Fixed bug GH-16232 (bitshift overflow on wbmp file content reading / fix backport from upstream). (David Carlier) + . Fixed bug GH-12264 (overflow/underflow on imagerotate degrees value) + (David Carlier) - LDAP: . Fixed bug GH-16032 (Various NULL pointer dereferencements in diff --git a/ext/gd/gd.c b/ext/gd/gd.c index bb2d05cc715..783500511b6 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -1194,6 +1194,11 @@ PHP_FUNCTION(imagerotate) RETURN_THROWS(); } + if (degrees < (double)(INT_MIN / 100) || degrees > (double)(INT_MAX / 100)) { + zend_argument_value_error(2, "must be between %d and %d", (INT_MIN / 100), (INT_MAX / 100)); + RETURN_THROWS(); + } + im_src = php_gd_libgdimageptr_from_zval_p(SIM); im_dst = gdImageRotateInterpolated(im_src, (const float)degrees, color); diff --git a/ext/gd/tests/gh16260.phpt b/ext/gd/tests/gh16260.phpt new file mode 100644 index 00000000000..563fc8d1627 --- /dev/null +++ b/ext/gd/tests/gh16260.phpt @@ -0,0 +1,22 @@ +--TEST-- +GH-16260 (Overflow/underflow on imagerotate degrees argument) +--EXTENSIONS-- +gd +--FILE-- +getMessage() . PHP_EOL; +} + +try { + imagerotate($im, PHP_INT_MAX, 0); +} catch (\ValueError $e) { + echo $e->getMessage(); +} +--EXPECTF-- +imagerotate(): Argument #2 ($angle) must be between %s and %s +imagerotate(): Argument #2 ($angle) must be between %s and %s