Merge branch 'PHP-7.4'

5 files changed, 109 insertions, 38 deletions

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 271e42f484..55fb2297ae 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1783,6 +1783,12 @@ PHP_FUNCTION(imagelayereffect)
 }
 /* }}} */
 
+#define CHECK_RGB_RANGE(component, name) \
+	if (component < 0 || component > 255) { \
+		php_error_docref(NULL, E_WARNING, #name " component is out of range"); \
+		RETURN_FALSE; \
+	}
+
 /* {{{ proto int imagecolorallocatealpha(resource im, int red, int green, int blue, int alpha)
    Allocate a color with an alpha level.  Works for true color and palette based images */
 PHP_FUNCTION(imagecolorallocatealpha)
@@ -1800,6 +1806,10 @@ PHP_FUNCTION(imagecolorallocatealpha)
 		RETURN_FALSE;
 	}
 
+	CHECK_RGB_RANGE(red, Red);
+	CHECK_RGB_RANGE(green, Green);
+	CHECK_RGB_RANGE(blue, Blue);
+
 	ct = gdImageColorAllocateAlpha(im, red, green, blue, alpha);
 	if (ct < 0) {
 		RETURN_FALSE;
@@ -2770,7 +2780,6 @@ PHP_FUNCTION(imagedestroy)
 }
 /* }}} */
 
-
 /* {{{ proto int imagecolorallocate(resource im, int red, int green, int blue)
    Allocate a color for an image */
 PHP_FUNCTION(imagecolorallocate)
@@ -2788,6 +2797,10 @@ PHP_FUNCTION(imagecolorallocate)
 		RETURN_FALSE;
 	}
 
+	CHECK_RGB_RANGE(red, Red);
+	CHECK_RGB_RANGE(green, Green);
+	CHECK_RGB_RANGE(blue, Blue);
+
 	ct = gdImageColorAllocate(im, red, green, blue);
 	if (ct < 0) {
 		RETURN_FALSE;
diff --git a/ext/gd/tests/imagecolorallocate_variation5.phpt b/ext/gd/tests/imagecolorallocate_variation5.phpt
index 43b51216c1..ac3e4bb20e 100644
--- a/ext/gd/tests/imagecolorallocate_variation5.phpt
+++ b/ext/gd/tests/imagecolorallocate_variation5.phpt
@@ -45,7 +45,7 @@ foreach($values as $key => $value) {
 };
 ?>
 ===DONE===
---EXPECT--
+--EXPECTF--
 *** Testing imagecolorallocate() : usage variations ***
 
 --Octal 000--
@@ -59,9 +59,15 @@ int(657930)
 int(657930)
 
 --Octal -012--
+
+Warning: imagecolorallocate(): Red component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Green component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
 bool(false)
-int(652810)
-int(657910)
 
 --Octal 0377--
 int(16714250)
@@ -79,9 +85,15 @@ int(657930)
 int(657930)
 
 --Hexa-decimal -0xA--
+
+Warning: imagecolorallocate(): Red component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Green component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
 bool(false)
-int(652810)
-int(657910)
 
 --Hexa-decimal 0xFF--
 int(16714250)
diff --git a/ext/gd/tests/imagecolorallocate_variation6.phpt b/ext/gd/tests/imagecolorallocate_variation6.phpt
index fcb7254712..a3649be71f 100644
--- a/ext/gd/tests/imagecolorallocate_variation6.phpt
+++ b/ext/gd/tests/imagecolorallocate_variation6.phpt
@@ -34,23 +34,75 @@ foreach($values as $key => $value) {
       //Need to be created every time to get expected return value
       $im_palette = imagecreate(200, 200);
       $im_true_color = imagecreatetruecolor(200, 200);
-      var_dump( imagecolorallocate($im_palette, $value, $value, $value) );
-      var_dump( imagecolorallocate($im_true_color, $value, $value, $value) );
+      var_dump( imagecolorallocate($im_palette, $value, 0, 0) );
+      var_dump( imagecolorallocate($im_true_color, $value, 0, 0) );
+      var_dump( imagecolorallocate($im_palette, 0, $value, 0) );
+      var_dump( imagecolorallocate($im_true_color, 0, $value, 0) );
+      var_dump( imagecolorallocate($im_palette, 0, 0, $value) );
+      var_dump( imagecolorallocate($im_true_color, 0, 0, $value) );
 };
 ?>
 ===DONE===
---EXPECT--
+--EXPECTF--
 *** Testing imagecolorallocate() : usage variations ***
 
 --Decimal 256--
-int(0)
-int(16843008)
+
+Warning: imagecolorallocate(): Red component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Red component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Green component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Green component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
+bool(false)
 
 --Octal 0400--
-int(0)
-int(16843008)
+
+Warning: imagecolorallocate(): Red component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Red component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Green component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Green component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
+bool(false)
 
 --Hexa-decimal 0x100--
-int(0)
-int(16843008)
+
+Warning: imagecolorallocate(): Red component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Red component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Green component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Green component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
+bool(false)
+
+Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
+bool(false)
 ===DONE===
diff --git a/ext/opcache/Optimizer/block_pass.c b/ext/opcache/Optimizer/block_pass.c
index 001e9d3360..505f004de3 100644
--- a/ext/opcache/Optimizer/block_pass.c
+++ b/ext/opcache/Optimizer/block_pass.c
@@ -1901,17 +1901,11 @@ void zend_optimize_cfg(zend_op_array *op_array, zend_optimizer_ctx *ctx)
 		zend_dump_op_array(op_array, ZEND_DUMP_CFG, "before block pass", &cfg);
 	}
 
-	if (op_array->last_var || op_array->T) {
-		bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
-		Tsource = zend_arena_calloc(&ctx->arena, op_array->last_var + op_array->T, sizeof(zend_op *));
-		same_t = zend_arena_alloc(&ctx->arena, op_array->last_var + op_array->T);
-		usage = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
-	} else {
-		bitset_len = 0;
-		Tsource = NULL;
-		same_t = NULL;
-		usage = NULL;
-	}
+	bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
+	Tsource = zend_arena_calloc(&ctx->arena, op_array->last_var + op_array->T, sizeof(zend_op *));
+	same_t = zend_arena_alloc(&ctx->arena, op_array->last_var + op_array->T);
+	usage = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
+
 	blocks = cfg.blocks;
 	end = blocks + cfg.blocks_count;
 	for (pass = 0; pass < PASSES; pass++) {
diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index a6475390a6..e67084b02a 100644
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -621,23 +621,23 @@ static int zend_inference_calc_binary_op_range(
 			break;
 		case ZEND_MUL:
 			if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
+				double dummy;
+				zend_long t1_overflow, t2_overflow, t3_overflow, t4_overflow;
 				op1_min = OP1_MIN_RANGE();
 				op2_min = OP2_MIN_RANGE();
 				op1_max = OP1_MAX_RANGE();
 				op2_max = OP2_MAX_RANGE();
-				t1 = op1_min * op2_min;
-				t2 = op1_min * op2_max;
-				t3 = op1_max * op2_min;
-				t4 = op1_max * op2_max;
+				ZEND_SIGNED_MULTIPLY_LONG(op1_min, op2_min, t1, dummy, t1_overflow);
+				ZEND_SIGNED_MULTIPLY_LONG(op1_min, op2_max, t2, dummy, t2_overflow);
+				ZEND_SIGNED_MULTIPLY_LONG(op1_max, op2_min, t3, dummy, t3_overflow);
+				ZEND_SIGNED_MULTIPLY_LONG(op1_max, op2_max, t4, dummy, t4_overflow);
+				(void) dummy;
+
 				// FIXME: more careful overflow checks?
-				if (OP1_RANGE_UNDERFLOW() ||
-					OP2_RANGE_UNDERFLOW() ||
-					OP1_RANGE_OVERFLOW()  ||
-					OP2_RANGE_OVERFLOW()  ||
-					(double)t1 != (double)op1_min * (double)op2_min ||
-					(double)t2 != (double)op1_min * (double)op2_max ||
-					(double)t3 != (double)op1_max * (double)op2_min ||
-					(double)t4 != (double)op1_max * (double)op2_max) {
+				if (OP1_RANGE_UNDERFLOW() || OP2_RANGE_UNDERFLOW() ||
+					OP1_RANGE_OVERFLOW() || OP2_RANGE_OVERFLOW()  ||
+					t1_overflow || t2_overflow || t3_overflow || t4_overflow
+				) {
 					tmp->underflow = 1;
 					tmp->overflow = 1;
 					tmp->min = ZEND_LONG_MIN;