From 0cc5e91d529cd8bbcbf277f950ee30026b3c5454 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Mon, 18 Apr 2016 23:31:03 -0700
Subject: Fix bug #71952: Corruption inside imageaffinematrixget

---
 ext/gd/gd.c                |  5 ++++-
 ext/gd/tests/bug71952.phpt | 14 ++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 ext/gd/tests/bug71952.phpt

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index b7203e7b8c..df0a32f1ab 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -5362,7 +5362,10 @@ PHP_FUNCTION(imageaffinematrixget)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number is expected as option");
 				RETURN_FALSE;
 			}
-			convert_to_double_ex(&options);
+			if(Z_TYPE_P(options) != IS_DOUBLE) {
+				Z_ADDREF_P(options);
+				convert_to_double_ex(&options);
+			}
 			angle = Z_DVAL_P(options);
 
 			if (type == GD_AFFINE_SHEAR_HORIZONTAL) {
diff --git a/ext/gd/tests/bug71952.phpt b/ext/gd/tests/bug71952.phpt
new file mode 100644
index 0000000000..f1f66bf26d
--- /dev/null
+++ b/ext/gd/tests/bug71952.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #71952 (Corruption inside imageaffinematrixget)
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+?>
+--FILE--
+<?php
+$vals=[str_repeat("A","200"),0,1,2,3,4,5,6,7,8,9];
+imageaffinematrixget(4,$vals[0]);
+var_dump($vals[0]);
+?>
+--EXPECTF--
+string(200) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
\ No newline at end of file
-- 
cgit v1.2.1