[php-src] Issue #20660: integer overflow in gd.c
[email protected] (chongwick)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/20660 Author: chongwick ### Description The following code: ```php <?php $v_10678 = 8; $v_10679 = 8; $v_10680 = imagecreatetruecolor($v_10678,$v_10679,); $v_10681 = 255; $v_10682 = 0; $v_10691 = 64; $v_10692 = 64; $v_10693 = imagecreatetruecolor($v_10691,$v_10692,); $v_10709 = 31; $v_10406 = '1234567890'; $v_10711 = 50; $v_10704 = 0; $v_10705 = 0; $v_10706 = 0; $v_10707 = imagecolorallocate($v_10693,$v_10704,$v_10705,$v_10706,); $v_10712 = imageellipse($v_10693,$v_10681,$v_10709,$v_10406,$v_10711,$v_10707,); ``` Resulted in this output: ``` /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:1802:7: runtime error: signed integer overflow: 9144947250114312600 + 762078937509526050 cannot be represented in type 'long' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:1802:7 ``` ### PHP Version ```plain nightly ``` ### Operating System _No response_