Bug #73279 [NEW]: Integer overflow in gdImageScaleBilinearPalette()

From: cmb Operating system: * PHP version: 5.6Git-2016-10-10 (Git) Package: GD related Bug Type: Bug Bug description:Integer overflow in gdImageScaleBilinearPalette() Description: ------------ On platforms where char is actually signed char an integer overflow can happen in gdImageScaleBilinearPalette due to sign extension when red, green and blue are passed to gdTrueColorAlpha(). This issue has been reported against upstream libgd[1], but as PHP's bundled libgd is affected as well, I'm forwarding. [1] <https://github.com/libgd/libgd/issues/330> Test script: --------------- <?php $src = imagecreate(100, 100); imagecolorallocate($src, 255, 255, 255); $dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED); printf("color: %x\n", imagecolorat($dst, 99, 99)); Expected result: ---------------- color: ffffff Actual result: -------------- color: fffffffffffefeff -- Edit bug report at https://bugs.php.net/bug.php?id=73279&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73279&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73279&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73279&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73279&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73279&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73279&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73279&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73279&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73279&r=support Expected behavior: https://bugs.php.net/fix.php?id=73279&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73279&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73279&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73279&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73279&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73279&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73279&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73279&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73279&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73279&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73279&r=mysqlcfg