[php-src] Issue #21163: integer overflow in gd.c
[email protected] (chongwick)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/21163 Author: chongwick ### Description The following code: ```php <?php $v_10698 = 150; $v_10740 = 50; $v_10700 = imagecreatetruecolor($v_10698,$v_10740,); $v_10701 = 255; $v_10702 = 255; $v_10703 = 255; $v_10704 = 127; $v_10705 = imagecolorallocatealpha($v_10700,$v_10701,$v_10702,$v_10703,$v_10704,); $v_10706 = False; $v_10707 = imagealphablending($v_10700,$v_10706,); $v_10708 = 1; $v_10709 = 1; $v_10710 = imagefill($v_10700,$v_10708,$v_10709,$v_10702,); $v_10711 = True; $v_10712 = imagesavealpha($v_10700,$v_10711,); $v_10713 = 'iVBORw0KGgoAAAANSUhEUgAAADIAAAAyAgMAAABjUWAiAAAACVBMVEUAAAD/AAD///9nGWQeAAAAAXRSTlMAQObYZgAAAEFJREFUKM9jYBimIASZIxoagOAwhoaGInisQJ4DksJQJKWoPCAnNIQYHsgChBX4eMSbiddlqH5A9R+q39HCZWgDAFxFGyOrmguhAAAAAElFTkSuQmCCPHP'; $v_10714 = base64_decode($v_10713,); $v_10715 = imagecreatefromstring($v_10714,); $v_10716 = 'iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAIAAACRXR/mAAAABnRSTlMAAAAAAABupgeRAAAAVklEQVRYw+3UQQqAMBAEwf3/p9eTBxEPiWAmWMU8oGFJqgAAuOpzWTX3xQUti+uRJTZ9V5aY1bOTFZLV7yZr9zt6ibv/qPXfrMpsGipbIy7oqQ8AYJED1plDy5PCu2sAAAAASUVORK5CYII='; $v_10717 = base64_decode($v_10716,); $v_10718 = imagecreatefromstring($v_10717,); $v_10720 = base64_decode($v_10706,); $v_10721 = imagecreatefromstring($v_10720,); $v_10723 = 0; $v_10724 = 0; $v_10725 = 0; $v_10726 = 50; $v_10727 = 50; $v_10728 = imagecopy($v_10700,$v_10715,$v_10705,$v_10723,$v_10724,$v_10725,$v_10726,$v_10727,); ``` Resulted in this output: ``` /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2358:33: runtime error: signed integer overflow: 2147483647 + 24 cannot be represented in type 'int' SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2358:33 ``` But I expected this output instead: ``` ``` ### PHP Version ```plain nightly ``` ### Operating System _No response_