ext/gd: imagefilter* using overflow checks.

devnexen · devnexen · commit ffb3cb685208 · 2025-04-08T22:55:46.000+01:00
Accept up to UINT_MAX * sizeof(int) colors.
diff --git a/ext/gd/gd.c b/ext/gd/gd.c
@@ -648,7 +648,7 @@ PHP_FUNCTION(imagesetstyle)
 	}
 
 	/* copy the style values in the stylearr */
-	stylearr = safe_emalloc(num_styles, sizeof(int), 0);
+	stylearr = safe_emalloc(num_styles * sizeof(int), false);
 
 	ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(styles), item) {
 		stylearr[index++] = zval_get_long(item);
@@ -3599,7 +3599,7 @@ static void php_image_filter_scatter(INTERNAL_FUNCTION_PARAMETERS)
 			RETURN_BOOL(gdImageScatter(im, (int)scatter_sub, (int)scatter_plus));
 		}
 
-		colors = emalloc(num_colors * sizeof(int));
+		colors = safe_emalloc(num_colors * sizeof(int), false);
 
 		ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(hash_colors), color) {
 			*(colors + i++) = (int) zval_get_long(color);

Original file line number	Diff line number	Diff line change
`@@ -648,7 +648,7 @@ PHP_FUNCTION(imagesetstyle)`
`648`	`648`	`}`
`649`	`649`
`650`	`650`	`/* copy the style values in the stylearr */`
`651`		`- stylearr = safe_emalloc(num_styles, sizeof(int), 0);`
	`651`	`+ stylearr = safe_emalloc(num_styles * sizeof(int), false);`
`652`	`652`
`653`	`653`	`ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(styles), item) {`
`654`	`654`	`stylearr[index++] = zval_get_long(item);`
`@@ -3599,7 +3599,7 @@ static void php_image_filter_scatter(INTERNAL_FUNCTION_PARAMETERS)`
`3599`	`3599`	`RETURN_BOOL(gdImageScatter(im, (int)scatter_sub, (int)scatter_plus));`
`3600`	`3600`	`}`
`3601`	`3601`
`3602`		`- colors = emalloc(num_colors * sizeof(int));`
	`3602`	`+ colors = safe_emalloc(num_colors * sizeof(int), false);`
`3603`	`3603`
`3604`	`3604`	`ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(hash_colors), color) {`
`3605`	`3605`	`*(colors + i++) = (int) zval_get_long(color);`