Unexpected nan value in ext/gd/libgd/gd_filter.c:386

[YuanchengJiang]

Description

The following code:

<?php
function makeFilter($resource, $matrix, $offset = 1.0)
{
return imageconvolution($resource, $matrix, $fusion, $offset);
}
$edgeMatrix = array(array(1, 0, 1), array(0, 5, 0), array(1, 0, 1));
$im = imagecreatetruecolor(40, 40);
makeFilter($im, $edgeMatrix);

Resulted in this output:

/php-src/ext/gd/libgd/gd_filter.c:386:45: runtime error: -nan is outside the range of representable values of type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/gd/libgd/gd_filter.c:386

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[devnexen]

seems the issue had been fixed upstream, issue only on the bundled version.

[cmb69]

Simplified reproducer:

$matrix = array(array(1, 0, 1), array(0, 5, 0), array(1, 0, 1));
$im = imagecreatetruecolor(40, 40);
imageconvolution($im, $matrix, 0, 1.0);

The problem is that we're passing zero as filter_div argument of gdImageConvolution() which doesn't seem to be supported be either our bundled libgd nor upstream.

Anyhow, I think we should catch that early, i.e.

 ext/gd/gd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 899dc05b3e..68ede9d023 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -3759,6 +3759,10 @@ PHP_FUNCTION(imageconvolution)
 			}
 		}
 	}
+	if (div == 0.0) {
+		zend_argument_value_error(3, "must not be zero");
+		RETURN_THROWS();
+	}
 	res = gdImageConvolution(im_src, matrix, (float)div, (float)offset);
 
 	if (res) {

I'm not sure whether checking for 0.0 is sufficient; we might need to some epsilon comparison. Or gdImageConvolution() would need some is_nan() checks (slower, and would only work for new versions).

[nielsdos]

That's not enough:

• 2.225E-307 is the smallest double, but will be converted to 0 when the cast happens, which triggers the same problem again
• div can be non-finite, which triggers the problem as well (e.g. imageconvolution($im, $matrix, NAN, 1.0);)
• the same issues happen with offset

I'll prepare a PR.