integer overflow in imagerectangle
Open
@devnexen is already working on this.
Since Sep 10, 2025.
Bug
Extension: gd
Status: Verified
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
The following code:
<?php
$v_19356 = 10;
$v_19357 = 10;
$v_19358 = imagecreatetruecolor($v_19356,$v_19357,);
$v_19359 = 1;
$v_19360 = 1;
$v_19361 = 1;
$v_19411 = 2147483647;
$v_19412 = -($v_19411);
$v_19416 = 'Foo';
$v_19417 = 'Bar';
$v_19418 = class_alias($v_19416,$v_19417,);
$v_19364 = imagerectangle($v_19358,$v_19359,$v_19360,$v_19361,$v_19412,$v_19418,);```
Resulted in this output:
/home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:693:32: runtime error: signed integer overflow: 1 - -2147483647 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:693:32
### PHP Version
```plain
nightly
Operating System
ubuntu 22.04
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.