Unexpected nan value in imageconvolution

[YuanchengJiang]

Description

The following code:

<?php
$image = imagecreatetruecolor(180, 30);
$gaussian = array(
array(1.0, 2.0, 1.0),
array(2.0, 4.0, 2.0),
array(1.0, 2.0, -INF)
);
imageconvolution($image, $gaussian, 16, 0);

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gd_filter.c:442:45: runtime error: -nan is outside the range of representable values of type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gd_filter.c:442:45 in 

To reproduce:

./php-src/sapi/cli/php  ./test.php

Commit:

7e5ad5caf8e249453a84b4f62565188cf69b877f

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

7e5ad5caf8e249453a84b4f62565188cf69b877f

Operating System

No response

[devnexen]

seems more a fix for libgd itself, will have better look later

[alexandre-daubois]

Present from 8.3. Shouldn't just a isnan check be added in gdImageConvolution?

diff --git a/ext/gd/libgd/gd_filter.c b/ext/gd/libgd/gd_filter.c
index db364c923ec..25306f57db4 100644
--- a/ext/gd/libgd/gd_filter.c
+++ b/ext/gd/libgd/gd_filter.c
@@ -9,6 +9,7 @@
 #endif
 #include <stdlib.h>
 #include <time.h>
+#include <Zend/zend_portability.h>
 
 /* Filters function added on 2003/12
  * by Pierre-Alain Joye (pierre@php.net)
@@ -383,6 +384,10 @@ int gdImageConvolution(gdImagePtr src, float filter[3][3], float filter_div, flo
                        new_g = (new_g > 255.0f)? 255.0f : ((new_g < 0.0f)? 0.0f:new_g);
                        new_b = (new_b > 255.0f)? 255.0f : ((new_b < 0.0f)? 0.0f:new_b);
 
+                       if (zend_isnan(new_r)) new_r = 0.0f;
+                       if (zend_isnan(new_g)) new_g = 0.0f;
+                       if (zend_isnan(new_b)) new_b = 0.0f;
+
                        new_pxl = gdImageColorAllocateAlpha(src, (int)new_r, (int)new_g, (int)new_b, new_a);
                        if (new_pxl == -1) {
                                new_pxl = gdImageColorClosestAlpha(src, (int)new_r, (int)new_g, (int)new_b, new_a);

I'm not sure which parts should be fixed upstream rather than in this repo though...

[devnexen]

Present from 8.3. Shouldn't just a isnan check be added in gdImageConvolution?

diff --git a/ext/gd/libgd/gd_filter.c b/ext/gd/libgd/gd_filter.c
index db364c923ec..25306f57db4 100644
--- a/ext/gd/libgd/gd_filter.c
+++ b/ext/gd/libgd/gd_filter.c
@@ -9,6 +9,7 @@
#endif
#include <stdlib.h>
#include <time.h>
+#include <Zend/zend_portability.h>

/* Filters function added on 2003/12

• by Pierre-Alain Joye (pierre@php.net)
  @@ -383,6 +384,10 @@ int gdImageConvolution(gdImagePtr src, float filter[3][3], float filter_div, flo
  new_g = (new_g > 255.0f)? 255.0f : ((new_g < 0.0f)? 0.0f:new_g);
  new_b = (new_b > 255.0f)? 255.0f : ((new_b < 0.0f)? 0.0f:new_b);

•                   if (zend_isnan(new_r)) new_r = 0.0f;
  

•                   if (zend_isnan(new_g)) new_g = 0.0f;
  

•                   if (zend_isnan(new_b)) new_b = 0.0f;
  

•                   new_pxl = gdImageColorAllocateAlpha(src, (int)new_r, (int)new_g, (int)new_b, new_a);
                    if (new_pxl == -1) {
                            new_pxl = gdImageColorClosestAlpha(src, (int)new_r, (int)new_g, (int)new_b, new_a);
  

I'm not sure which parts should be fixed upstream rather than in this repo though...

It is preferable to avoid using zend api in the libgd itself but I ll look into it..