diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-04-18 23:31:03 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2016-04-18 23:33:21 -0700 |
| commit | f061867fd385109861d128ae6f3e2484fc4daa72 (patch) | |
| tree | c07c8af61a216fa7025311ab4e09d21197028801 | |
| parent | ffc697ac27377df3f295c7dc7281b578759645cb (diff) | |
| download | php-git-f061867fd385109861d128ae6f3e2484fc4daa72.tar.gz | |
Fix bug #71952: Corruption inside imageaffinematrixget
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/gd/gd.c | 5 | ||||
| -rw-r--r-- | ext/gd/tests/bug71952.phpt | 14 |
3 files changed, 21 insertions, 1 deletions
@@ -16,6 +16,9 @@ PHP NEWS - Date: . Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt) +- GD: + . Fixed bug #71952 (Corruption inside imageaffinematrixget). (Stas) + - OCI8: . Fixed bug #71422 (Fix ORA-01438: value larger than specified precision allowed for this column). (Chris Jones) diff --git a/ext/gd/gd.c b/ext/gd/gd.c index b7203e7b8c..df0a32f1ab 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -5362,7 +5362,10 @@ PHP_FUNCTION(imageaffinematrixget) php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number is expected as option"); RETURN_FALSE; } - convert_to_double_ex(&options); + if(Z_TYPE_P(options) != IS_DOUBLE) { + Z_ADDREF_P(options); + convert_to_double_ex(&options); + } angle = Z_DVAL_P(options); if (type == GD_AFFINE_SHEAR_HORIZONTAL) { diff --git a/ext/gd/tests/bug71952.phpt b/ext/gd/tests/bug71952.phpt new file mode 100644 index 0000000000..f1f66bf26d --- /dev/null +++ b/ext/gd/tests/bug71952.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #71952 (Corruption inside imageaffinematrixget) +--SKIPIF-- +<?php + if(!extension_loaded('gd')){ die('skip gd extension not available'); } +?> +--FILE-- +<?php +$vals=[str_repeat("A","200"),0,1,2,3,4,5,6,7,8,9]; +imageaffinematrixget(4,$vals[0]); +var_dump($vals[0]); +?> +--EXPECTF-- +string(200) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
\ No newline at end of file |