@@ -652,7 +652,15 @@ PHP_FUNCTION(imagesetstyle)
652
652
stylearr = safe_emalloc (sizeof (int ), num_styles , 0 );
653
653
654
654
ZEND_HASH_FOREACH_VAL (Z_ARRVAL_P (styles ), item ) {
655
- stylearr [index ++ ] = zval_get_long (item );
655
+ bool failed = false;
656
+ ZVAL_DEREF (item );
657
+ zend_long tmp = zval_try_get_long (item , & failed );
658
+ if (failed ) {
659
+ efree (stylearr );
660
+ zend_argument_value_error (2 , "value must be of type int, %s given" , zend_zval_type_name (item ));
661
+ RETURN_THROWS ();
662
+ }
663
+ stylearr [index ++ ] = tmp ;
656
664
} ZEND_HASH_FOREACH_END ();
657
665
658
666
gdImageSetStyle (im , stylearr , index );
@@ -3648,7 +3656,20 @@ static void php_image_filter_scatter(INTERNAL_FUNCTION_PARAMETERS)
3648
3656
colors = emalloc (num_colors * sizeof (int ));
3649
3657
3650
3658
ZEND_HASH_FOREACH_VAL (Z_ARRVAL_P (hash_colors ), color ) {
3651
- * (colors + i ++ ) = (int ) zval_get_long (color );
3659
+ bool failed = false;
3660
+ ZVAL_DEREF (color );
3661
+ zend_long tmp = zval_try_get_long (color , & failed );
3662
+ if (failed ) {
3663
+ efree (colors );
3664
+ zend_argument_value_error (5 , "value must be of type int, %s given" , zend_zval_type_name (color ));
3665
+ RETURN_THROWS ();
3666
+ }
3667
+ if (tmp < 0 || ZEND_LONG_INT_OVFL (tmp )) {
3668
+ efree (colors );
3669
+ zend_argument_value_error (5 , "value must be between 0 and %d" , INT_MAX );
3670
+ RETURN_THROWS ();
3671
+ }
3672
+ * (colors + i ++ ) = (int ) tmp ;
3652
3673
} ZEND_HASH_FOREACH_END ();
3653
3674
3654
3675
RETVAL_BOOL (gdImageScatterColor (im , (int )scatter_sub , (int )scatter_plus , colors , num_colors ));
@@ -3831,6 +3852,7 @@ PHP_FUNCTION(imagecrop)
3831
3852
gdRect rect ;
3832
3853
zval * z_rect ;
3833
3854
zval * tmp ;
3855
+ zend_long r ;
3834
3856
3835
3857
ZEND_PARSE_PARAMETERS_START (2 , 2 )
3836
3858
Z_PARAM_OBJECT_OF_CLASS (IM , gd_image_ce )
@@ -3840,28 +3862,48 @@ PHP_FUNCTION(imagecrop)
3840
3862
im = php_gd_libgdimageptr_from_zval_p (IM );
3841
3863
3842
3864
if ((tmp = zend_hash_str_find (Z_ARRVAL_P (z_rect ), "x" , sizeof ("x" ) - 1 )) != NULL ) {
3843
- rect .x = zval_get_long (tmp );
3865
+ r = zval_get_long (tmp );
3866
+ if (ZEND_LONG_EXCEEDS_INT (r )) {
3867
+ zend_argument_value_error (2 , "\"x\" key must be between %d and %d\n" , INT_MIN , INT_MAX );
3868
+ RETURN_THROWS ();
3869
+ }
3870
+ rect .x = (int )r ;
3844
3871
} else {
3845
3872
zend_argument_value_error (2 , "must have an \"x\" key" );
3846
3873
RETURN_THROWS ();
3847
3874
}
3848
3875
3849
3876
if ((tmp = zend_hash_str_find (Z_ARRVAL_P (z_rect ), "y" , sizeof ("y" ) - 1 )) != NULL ) {
3850
- rect .y = zval_get_long (tmp );
3877
+ r = zval_get_long (tmp );
3878
+ if (ZEND_LONG_EXCEEDS_INT (r )) {
3879
+ zend_argument_value_error (2 , "\"y\" key must be between %d and %d\n" , INT_MIN , INT_MAX );
3880
+ RETURN_THROWS ();
3881
+ }
3882
+ rect .y = (int )r ;
3851
3883
} else {
3852
3884
zend_argument_value_error (2 , "must have a \"y\" key" );
3853
3885
RETURN_THROWS ();
3854
3886
}
3855
3887
3856
3888
if ((tmp = zend_hash_str_find (Z_ARRVAL_P (z_rect ), "width" , sizeof ("width" ) - 1 )) != NULL ) {
3857
- rect .width = zval_get_long (tmp );
3889
+ r = zval_get_long (tmp );
3890
+ if (ZEND_LONG_EXCEEDS_INT (r )) {
3891
+ zend_argument_value_error (2 , "\"width\" key must be between %d and %d\n" , INT_MIN , INT_MAX );
3892
+ RETURN_THROWS ();
3893
+ }
3894
+ rect .width = (int )r ;
3858
3895
} else {
3859
3896
zend_argument_value_error (2 , "must have a \"width\" key" );
3860
3897
RETURN_THROWS ();
3861
3898
}
3862
3899
3863
3900
if ((tmp = zend_hash_str_find (Z_ARRVAL_P (z_rect ), "height" , sizeof ("height" ) - 1 )) != NULL ) {
3864
- rect .height = zval_get_long (tmp );
3901
+ r = zval_get_long (tmp );
3902
+ if (ZEND_LONG_EXCEEDS_INT (r )) {
3903
+ zend_argument_value_error (2 , "\"height\" key must be between %d and %d\n" , INT_MIN , INT_MAX );
3904
+ RETURN_THROWS ();
3905
+ }
3906
+ rect .height = (int )r ;
3865
3907
} else {
3866
3908
zend_argument_value_error (2 , "must have a \"height\" key" );
3867
3909
RETURN_THROWS ();
0 commit comments