Bug #66625 [Opn]: imagescale() segmentation fault on 64bits environment

From: Date: Tue, 07 Jun 2016 04:03:43 +0000
Subject: Bug #66625 [Opn]: imagescale() segmentation fault on 64bits environment
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-201495@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=66625&edit=1

 ID:                 66625
 Updated by:         pajoye@php.net
 Reported by:        yoya at awm dot jp
 Summary:            imagescale() segmentation fault on 64bits
                     environment
 Status:             Open
 Type:               Bug
 Package:            GD related
 Operating System:   Any
 PHP Version:        5.5.8
 Block user comment: N
 Private report:     N

 New Comment:

They are different issues. #72337 is about new width or height being zero.

This one is wrong type used for the new_width and height, as described precisely here.

Patches coming, running further tests.


Previous Comments:
------------------------------------------------------------------------
[2016-06-06 18:43:38] cmb@php.net

Related To: Bug #72337

------------------------------------------------------------------------
[2014-03-24 22:47:00] mwanat at forall dot pl

Confirmed on 64Bit CentOS & PHP 5.5.10

------------------------------------------------------------------------
[2014-02-02 03:50:22] yoya at awm dot jp

Description:
------------
* ext/gd.c
----
PHP_FUNCTION(imagescale)
{
        zval *IM;
        gdImagePtr im;
        gdImagePtr im_scaled;
        int new_width, new_height = -1;
        gdInterpolationMethod method = GD_BILINEAR_FIXED;

        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rl|ll", &IM,
&new_width, &new_height, &method) == FAILURE)  {
----

On 64 bits environment ,'l'(long) have 64 bits width, int and gdInterpolationMethod type
have 32 bits, so IM pointer be destroyed by value of other variables.

This problem related to id:65171, I guess.
- https://bugs.php.net/bug.php?id=65171


Test script:
---------------
<?php

$data = file_get_contents($argv[1]);
$im = ImageCreateFromString($data);
$im2 = imagescale($im, 256, 192, IMG_NEAREST_NEIGHBOUR);
imagepng($im2, 'output.png');

Actual result:
--------------
Segmentation fault


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=66625&edit=1


Thread (4 messages)

« previous php.bugs (#201495) next »