Skip to content

Commit f061867

Browse files
committed
Fix bug #71952: Corruption inside imageaffinematrixget
1 parent ffc697a commit f061867

File tree

3 files changed

+21
-1
lines changed

3 files changed

+21
-1
lines changed

NEWS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@ PHP NEWS
1616
- Date:
1717
. Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt)
1818

19+
- GD:
20+
. Fixed bug #71952 (Corruption inside imageaffinematrixget). (Stas)
21+
1922
- OCI8:
2023
. Fixed bug #71422 (Fix ORA-01438: value larger than specified precision
2124
allowed for this column). (Chris Jones)

ext/gd/gd.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5362,7 +5362,10 @@ PHP_FUNCTION(imageaffinematrixget)
53625362
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number is expected as option");
53635363
RETURN_FALSE;
53645364
}
5365-
convert_to_double_ex(&options);
5365+
if(Z_TYPE_P(options) != IS_DOUBLE) {
5366+
Z_ADDREF_P(options);
5367+
convert_to_double_ex(&options);
5368+
}
53665369
angle = Z_DVAL_P(options);
53675370

53685371
if (type == GD_AFFINE_SHEAR_HORIZONTAL) {

ext/gd/tests/bug71952.phpt

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
Bug #71952 (Corruption inside imageaffinematrixget)
3+
--SKIPIF--
4+
<?php
5+
if(!extension_loaded('gd')){ die('skip gd extension not available'); }
6+
?>
7+
--FILE--
8+
<?php
9+
$vals=[str_repeat("A","200"),0,1,2,3,4,5,6,7,8,9];
10+
imageaffinematrixget(4,$vals[0]);
11+
var_dump($vals[0]);
12+
?>
13+
--EXPECTF--
14+
string(200) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

0 commit comments

Comments
 (0)