diff --git a/ext/gd/gd.c b/ext/gd/gd.c index cce2a5ca42fc9..44e468410629e 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -832,6 +832,11 @@ PHP_FUNCTION(imagefilledellipse) RETURN_THROWS(); } + if (w < 0 || ZEND_LONG_INT_OVFL(w)) { + zend_argument_value_error(4, "must be between 0 and %d", INT_MAX); + RETURN_THROWS(); + } + im = php_gd_libgdimageptr_from_zval_p(IM); gdImageFilledEllipse(im, cx, cy, w, h, color); diff --git a/ext/gd/tests/gh19578.phpt b/ext/gd/tests/gh19578.phpt new file mode 100644 index 0000000000000..15d10f752d0d4 --- /dev/null +++ b/ext/gd/tests/gh19578.phpt @@ -0,0 +1,27 @@ +--TEST-- +GH-19578: imagefilledellipse underflow on width argument +--EXTENSIONS-- +gd +--SKIPIF-- + +--FILE-- +getMessage(), PHP_EOL; +} + +try { + imagefilledellipse($src, 0, 0, -16, 254, 0); +} catch (\ValueError $e) { + echo $e->getMessage(); +} +?> +--EXPECTF-- +imagefilledellipse(): Argument #4 ($width) must be between 0 and %d +imagefilledellipse(): Argument #4 ($width) must be between 0 and %d diff --git a/ext/gd/tests/gh19578_32bits.phpt b/ext/gd/tests/gh19578_32bits.phpt new file mode 100644 index 0000000000000..2cb73a60987e2 --- /dev/null +++ b/ext/gd/tests/gh19578_32bits.phpt @@ -0,0 +1,20 @@ +--TEST-- +GH-19578: imagefilledellipse underflow on width argument +--EXTENSIONS-- +gd +--SKIPIF-- + +--FILE-- +getMessage(); +} +?> +--EXPECTF-- +imagefilledellipse(): Argument #4 ($width) must be between 0 and %d