php / php/php-src

integer overflow in bundled gdImageCopy()

未关闭
#21,163 0 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

@devnexen 已经在做这个了。

开始于 2026年2月8日。

Bug Extension: gd Status: Verified
主要语言
C
星标
40.4k
派生
8.2k
平均合并
2 天 15 小时
30 天内合并 PR
103

描述

Description

The following code:

<?php
$v_10698 = 150;
$v_10740 = 50;
$v_10700 = imagecreatetruecolor($v_10698,$v_10740,);
$v_10701 = 255;
$v_10702 = 255;
$v_10703 = 255;
$v_10704 = 127;
$v_10705 = imagecolorallocatealpha($v_10700,$v_10701,$v_10702,$v_10703,$v_10704,);
$v_10706 = False;
$v_10707 = imagealphablending($v_10700,$v_10706,);
$v_10708 = 1;
$v_10709 = 1;
$v_10710 = imagefill($v_10700,$v_10708,$v_10709,$v_10702,);
$v_10711 = True;
$v_10712 = imagesavealpha($v_10700,$v_10711,);
$v_10713 = 'iVBORw0KGgoAAAANSUhEUgAAADIAAAAyAgMAAABjUWAiAAAACVBMVEUAAAD/AAD///9nGWQeAAAAAXRSTlMAQObYZgAAAEFJREFUKM9jYBimIASZIxoagOAwhoaGInisQJ4DksJQJKWoPCAnNIQYHsgChBX4eMSbiddlqH5A9R+q39HCZWgDAFxFGyOrmguhAAAAAElFTkSuQmCCPHP';
$v_10714 = base64_decode($v_10713,);
$v_10715 = imagecreatefromstring($v_10714,);
$v_10716 = 'iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAIAAACRXR/mAAAABnRSTlMAAAAAAABupgeRAAAAVklEQVRYw+3UQQqAMBAEwf3/p9eTBxEPiWAmWMU8oGFJqgAAuOpzWTX3xQUti+uRJTZ9V5aY1bOTFZLV7yZr9zt6ibv/qPXfrMpsGipbIy7oqQ8AYJED1plDy5PCu2sAAAAASUVORK5CYII=';
$v_10717 = base64_decode($v_10716,);
$v_10718 = imagecreatefromstring($v_10717,);
$v_10720 = base64_decode($v_10706,);
$v_10721 = imagecreatefromstring($v_10720,);
$v_10723 = 0;
$v_10724 = 0;
$v_10725 = 0;
$v_10726 = 50;
$v_10727 = 50;
$v_10728 = imagecopy($v_10700,$v_10715,$v_10705,$v_10723,$v_10724,$v_10725,$v_10726,$v_10727,);

Resulted in this output:

/home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2358:33: runtime error: signed integer overflow: 2147483647 + 24 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2358:33

But I expected this output instead:

PHP Version
nightly
Operating System

No response

贡献指南

打开贡献指南

从这里开始

  1. 先读完整个 Issue,再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库,在一个分支上完成修改。
  4. 提交 Pull Request,并在描述里引用这个 Issue 编号。

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。