integer overflow in bundled gdImageCopy()
Abierto
@devnexen ya está trabajando en esto.
Desde el 8/2/2026.
Bug
Extension: gd
Status: Verified
- Lenguaje dominante
- C
- Estrellas
- 40.4k
- Forks
- 8.2k
- Merge medio
- 2 d 13 h
- PR fusionados (30 d)
- 96
Descripción
Description
The following code:
<?php
$v_10698 = 150;
$v_10740 = 50;
$v_10700 = imagecreatetruecolor($v_10698,$v_10740,);
$v_10701 = 255;
$v_10702 = 255;
$v_10703 = 255;
$v_10704 = 127;
$v_10705 = imagecolorallocatealpha($v_10700,$v_10701,$v_10702,$v_10703,$v_10704,);
$v_10706 = False;
$v_10707 = imagealphablending($v_10700,$v_10706,);
$v_10708 = 1;
$v_10709 = 1;
$v_10710 = imagefill($v_10700,$v_10708,$v_10709,$v_10702,);
$v_10711 = True;
$v_10712 = imagesavealpha($v_10700,$v_10711,);
$v_10713 = 'iVBORw0KGgoAAAANSUhEUgAAADIAAAAyAgMAAABjUWAiAAAACVBMVEUAAAD/AAD///9nGWQeAAAAAXRSTlMAQObYZgAAAEFJREFUKM9jYBimIASZIxoagOAwhoaGInisQJ4DksJQJKWoPCAnNIQYHsgChBX4eMSbiddlqH5A9R+q39HCZWgDAFxFGyOrmguhAAAAAElFTkSuQmCCPHP';
$v_10714 = base64_decode($v_10713,);
$v_10715 = imagecreatefromstring($v_10714,);
$v_10716 = 'iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAIAAACRXR/mAAAABnRSTlMAAAAAAABupgeRAAAAVklEQVRYw+3UQQqAMBAEwf3/p9eTBxEPiWAmWMU8oGFJqgAAuOpzWTX3xQUti+uRJTZ9V5aY1bOTFZLV7yZr9zt6ibv/qPXfrMpsGipbIy7oqQ8AYJED1plDy5PCu2sAAAAASUVORK5CYII=';
$v_10717 = base64_decode($v_10716,);
$v_10718 = imagecreatefromstring($v_10717,);
$v_10720 = base64_decode($v_10706,);
$v_10721 = imagecreatefromstring($v_10720,);
$v_10723 = 0;
$v_10724 = 0;
$v_10725 = 0;
$v_10726 = 50;
$v_10727 = 50;
$v_10728 = imagecopy($v_10700,$v_10715,$v_10705,$v_10723,$v_10724,$v_10725,$v_10726,$v_10727,);
Resulted in this output:
/home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2358:33: runtime error: signed integer overflow: 2147483647 + 24 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2358:33
But I expected this output instead:
PHP Version
nightly
Operating System
No response
Guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Evaluación
Este issue todavía no se ha evaluado.