diff options
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/gd/gd.c | 5 | ||||
| -rw-r--r-- | ext/gd/tests/bug71952.phpt | 14 |
3 files changed, 21 insertions, 1 deletions
@@ -16,6 +16,9 @@ PHP NEWS - Date: . Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt) +- GD: + . Fixed bug #71952 (Corruption inside imageaffinematrixget). (Stas) + - OCI8: . Fixed bug #71422 (Fix ORA-01438: value larger than specified precision allowed for this column). (Chris Jones) diff --git a/ext/gd/gd.c b/ext/gd/gd.c index b7203e7b8c..df0a32f1ab 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -5362,7 +5362,10 @@ PHP_FUNCTION(imageaffinematrixget) php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number is expected as option"); RETURN_FALSE; } - convert_to_double_ex(&options); + if(Z_TYPE_P(options) != IS_DOUBLE) { + Z_ADDREF_P(options); + convert_to_double_ex(&options); + } angle = Z_DVAL_P(options); if (type == GD_AFFINE_SHEAR_HORIZONTAL) { diff --git a/ext/gd/tests/bug71952.phpt b/ext/gd/tests/bug71952.phpt new file mode 100644 index 0000000000..f1f66bf26d --- /dev/null +++ b/ext/gd/tests/bug71952.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #71952 (Corruption inside imageaffinematrixget) +--SKIPIF-- +<?php + if(!extension_loaded('gd')){ die('skip gd extension not available'); } +?> +--FILE-- +<?php +$vals=[str_repeat("A","200"),0,1,2,3,4,5,6,7,8,9]; +imageaffinematrixget(4,$vals[0]); +var_dump($vals[0]); +?> +--EXPECTF-- +string(200) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
\ No newline at end of file |