diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 3b824430597b6..6b41efd949a2c 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -3687,13 +3687,25 @@ PHP_FUNCTION(imageaffine) if ((zval_affine_elem = zend_hash_index_find(Z_ARRVAL_P(z_affine), i)) != NULL) { switch (Z_TYPE_P(zval_affine_elem)) { case IS_LONG: - affine[i] = Z_LVAL_P(zval_affine_elem); + affine[i] = Z_LVAL_P(zval_affine_elem); + if (affine[i] < INT_MIN || affine[i] > INT_MAX) { + zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX); + RETURN_THROWS(); + } break; case IS_DOUBLE: affine[i] = Z_DVAL_P(zval_affine_elem); + if (affine[i] < INT_MIN || affine[i] > INT_MAX) { + zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX); + RETURN_THROWS(); + } break; case IS_STRING: affine[i] = zval_get_double(zval_affine_elem); + if (affine[i] < INT_MIN || affine[i] > INT_MAX) { + zend_argument_value_error(2, "element %i must be between %d and %d", i, INT_MIN, INT_MAX); + RETURN_THROWS(); + } break; default: zend_argument_type_error(3, "contains invalid type for element %i", i); diff --git a/ext/gd/tests/gh16322.phpt b/ext/gd/tests/gh16322.phpt new file mode 100644 index 0000000000000..1edc27285d2db --- /dev/null +++ b/ext/gd/tests/gh16322.phpt @@ -0,0 +1,27 @@ +--TEST-- +GH-16322 (imageaffine overflow/underflow on affine matrix) +--EXTENSIONS-- +gd +--INI-- +memory_limit=-1 +--FILE-- +getMessage() . PHP_EOL; +} +$matrix[0] = 1; +$matrix[3] = -INF; +try { + imageaffine($src, $matrix); +} catch (\ValueError $e) { + echo $e->getMessage(); +} +?> +--EXPECTF-- +imageaffine(): Argument #2 ($affine) element 0 must be between %s and %d +imageaffine(): Argument #2 ($affine) element 3 must be between %s and %d