Skip to content

Commit 836241c

Browse files
committed
ext/gd: calls with array types check strengthening.
1 parent 30ce9ac commit 836241c

File tree

1 file changed

+48
-6
lines changed

1 file changed

+48
-6
lines changed

ext/gd/gd.c

Lines changed: 48 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -652,7 +652,15 @@ PHP_FUNCTION(imagesetstyle)
652652
stylearr = safe_emalloc(sizeof(int), num_styles, 0);
653653

654654
ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(styles), item) {
655-
stylearr[index++] = zval_get_long(item);
655+
bool failed = false;
656+
ZVAL_DEREF(item);
657+
zend_long tmp = zval_try_get_long(item, &failed);
658+
if (failed) {
659+
efree(stylearr);
660+
zend_argument_value_error(2, "value must be of type int, %s given", zend_zval_type_name(item));
661+
RETURN_THROWS();
662+
}
663+
stylearr[index++] = tmp;
656664
} ZEND_HASH_FOREACH_END();
657665

658666
gdImageSetStyle(im, stylearr, index);
@@ -3648,7 +3656,20 @@ static void php_image_filter_scatter(INTERNAL_FUNCTION_PARAMETERS)
36483656
colors = emalloc(num_colors * sizeof(int));
36493657

36503658
ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(hash_colors), color) {
3651-
*(colors + i++) = (int) zval_get_long(color);
3659+
bool failed = false;
3660+
ZVAL_DEREF(color);
3661+
zend_long tmp = zval_try_get_long(color, &failed);
3662+
if (failed) {
3663+
efree(colors);
3664+
zend_argument_value_error(5, "value must be of type int, %s given", zend_zval_type_name(color));
3665+
RETURN_THROWS();
3666+
}
3667+
if (tmp < 0 || ZEND_LONG_INT_OVFL(tmp)) {
3668+
efree(colors);
3669+
zend_argument_value_error(5, "value must be between 0 and %d", INT_MAX);
3670+
RETURN_THROWS();
3671+
}
3672+
*(colors + i++) = (int) tmp;
36523673
} ZEND_HASH_FOREACH_END();
36533674

36543675
RETVAL_BOOL(gdImageScatterColor(im, (int)scatter_sub, (int)scatter_plus, colors, num_colors));
@@ -3831,6 +3852,7 @@ PHP_FUNCTION(imagecrop)
38313852
gdRect rect;
38323853
zval *z_rect;
38333854
zval *tmp;
3855+
zend_long r;
38343856

38353857
ZEND_PARSE_PARAMETERS_START(2, 2)
38363858
Z_PARAM_OBJECT_OF_CLASS(IM, gd_image_ce)
@@ -3840,28 +3862,48 @@ PHP_FUNCTION(imagecrop)
38403862
im = php_gd_libgdimageptr_from_zval_p(IM);
38413863

38423864
if ((tmp = zend_hash_str_find(Z_ARRVAL_P(z_rect), "x", sizeof("x") -1)) != NULL) {
3843-
rect.x = zval_get_long(tmp);
3865+
r = zval_get_long(tmp);
3866+
if (ZEND_LONG_EXCEEDS_INT(r)) {
3867+
zend_argument_value_error(2, "\"x\" key must be between %d and %d\n", INT_MIN, INT_MAX);
3868+
RETURN_THROWS();
3869+
}
3870+
rect.x = (int)r;
38443871
} else {
38453872
zend_argument_value_error(2, "must have an \"x\" key");
38463873
RETURN_THROWS();
38473874
}
38483875

38493876
if ((tmp = zend_hash_str_find(Z_ARRVAL_P(z_rect), "y", sizeof("y") - 1)) != NULL) {
3850-
rect.y = zval_get_long(tmp);
3877+
r = zval_get_long(tmp);
3878+
if (ZEND_LONG_EXCEEDS_INT(r)) {
3879+
zend_argument_value_error(2, "\"y\" key must be between %d and %d\n", INT_MIN, INT_MAX);
3880+
RETURN_THROWS();
3881+
}
3882+
rect.y = (int)r;
38513883
} else {
38523884
zend_argument_value_error(2, "must have a \"y\" key");
38533885
RETURN_THROWS();
38543886
}
38553887

38563888
if ((tmp = zend_hash_str_find(Z_ARRVAL_P(z_rect), "width", sizeof("width") - 1)) != NULL) {
3857-
rect.width = zval_get_long(tmp);
3889+
r = zval_get_long(tmp);
3890+
if (ZEND_LONG_EXCEEDS_INT(r)) {
3891+
zend_argument_value_error(2, "\"width\" key must be between %d and %d\n", INT_MIN, INT_MAX);
3892+
RETURN_THROWS();
3893+
}
3894+
rect.width = (int)r;
38583895
} else {
38593896
zend_argument_value_error(2, "must have a \"width\" key");
38603897
RETURN_THROWS();
38613898
}
38623899

38633900
if ((tmp = zend_hash_str_find(Z_ARRVAL_P(z_rect), "height", sizeof("height") - 1)) != NULL) {
3864-
rect.height = zval_get_long(tmp);
3901+
r = zval_get_long(tmp);
3902+
if (ZEND_LONG_EXCEEDS_INT(r)) {
3903+
zend_argument_value_error(2, "\"height\" key must be between %d and %d\n", INT_MIN, INT_MAX);
3904+
RETURN_THROWS();
3905+
}
3906+
rect.height = (int)r;
38653907
} else {
38663908
zend_argument_value_error(2, "must have a \"height\" key");
38673909
RETURN_THROWS();

0 commit comments

Comments
 (0)