diff --git a/NEWS b/NEWS index f068c6ab833..cf9a0eddc25 100644 --- a/NEWS +++ b/NEWS @@ -24,6 +24,7 @@ PHP NEWS . Fixed ftp_pasv arginfo. (carusogabriel) -GD: + . Fixed bug #73957 (signed integer conversion in imagescale()). (cmb) . Fixed bug #76041 (null pointer access crashed php). (cmb) . Fixed imagesetinterpolation arginfo. (Gabriel Caruso) diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 1b9bc8c85eb..2e021de7885 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -4842,7 +4842,7 @@ PHP_FUNCTION(imagescale) } } - if (tmp_h <= 0 || tmp_w <= 0) { + if (tmp_h <= 0 || tmp_h > INT_MAX || tmp_w <= 0 || tmp_w > INT_MAX) { RETURN_FALSE; } diff --git a/ext/gd/tests/bug73957.phpt b/ext/gd/tests/bug73957.phpt new file mode 100644 index 00000000000..370956f032b --- /dev/null +++ b/ext/gd/tests/bug73957.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #73957 (signed integer conversion in imagescale()) +--SKIPIF-- + +--FILE-- + +===DONE=== +--EXPECT-- +bool(false) +===DONE===