diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-04-18 23:31:03 -0700 |
|---|---|---|
| committer | Ferenc Kovacs <tyrael@php.net> | 2016-04-28 02:27:40 +0200 |
| commit | 0cc5e91d529cd8bbcbf277f950ee30026b3c5454 (patch) | |
| tree | db6dc11dad8ca98e0fdd335db869d5f22e015fe4 | |
| parent | c829b4e9794d7744d400d3669f161d4c6f17a502 (diff) | |
| download | php-git-0cc5e91d529cd8bbcbf277f950ee30026b3c5454.tar.gz | |
Fix bug #71952: Corruption inside imageaffinematrixget
| -rw-r--r-- | ext/gd/gd.c | 5 | ||||
| -rw-r--r-- | ext/gd/tests/bug71952.phpt | 14 |
2 files changed, 18 insertions, 1 deletions
diff --git a/ext/gd/gd.c b/ext/gd/gd.c index b7203e7b8c..df0a32f1ab 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -5362,7 +5362,10 @@ PHP_FUNCTION(imageaffinematrixget) php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number is expected as option"); RETURN_FALSE; } - convert_to_double_ex(&options); + if(Z_TYPE_P(options) != IS_DOUBLE) { + Z_ADDREF_P(options); + convert_to_double_ex(&options); + } angle = Z_DVAL_P(options); if (type == GD_AFFINE_SHEAR_HORIZONTAL) { diff --git a/ext/gd/tests/bug71952.phpt b/ext/gd/tests/bug71952.phpt new file mode 100644 index 0000000000..f1f66bf26d --- /dev/null +++ b/ext/gd/tests/bug71952.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #71952 (Corruption inside imageaffinematrixget) +--SKIPIF-- +<?php + if(!extension_loaded('gd')){ die('skip gd extension not available'); } +?> +--FILE-- +<?php +$vals=[str_repeat("A","200"),0,1,2,3,4,5,6,7,8,9]; +imageaffinematrixget(4,$vals[0]); +var_dump($vals[0]); +?> +--EXPECTF-- +string(200) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
\ No newline at end of file |