Bug #77272 [Asn->Csd]: imagescale() may return image resource on failure

Edit report at https://bugs.php.net/bug.php?id=77272&edit=1 ID: 77272 Updated by: cmb@php.net Reported by: cmb@php.net Summary: imagescale() may return image resource on failure -Status: Assigned +Status: Closed Type: Bug Package: GD related Operating System: * PHP Version: 7.2.13 Assigned To: cmb Block user comment: N Private report: N New Comment: Automatic comment on behalf of cmbecker69@gmx.de Revision: http://git.php.net/?p=php-src.git;a=commit;h=772b1cb245ebe19e220a2552d1e2b700d15f2c68 Log: Fix #77272: imagescale() may return image resource on failure Previous Comments: ------------------------------------------------------------------------ [2018-12-09 22:19:52] cmb@php.net Related To: Bug #77269 ------------------------------------------------------------------------ [2018-12-09 15:29:12] cmb@php.net Actually, this is not a security issue, but nonetheless should kept private until bug #77269 is resolved, since the reproduce script would hint at that bug. ------------------------------------------------------------------------ [2018-12-09 15:28:50] cmb@php.net Description: ------------ If either dimension of an image passed to imagescale() is greater than or equal to 0x1000000‬, the image cannot be scaled, but still gdImageScale() of the *bundled* libgd would return a (blank) image. This issue is fixed in upstream libgd as of 2.2.3. Note that the reproduce script given below requires an appropriate fix for bug #77269 regarding bundled libgd (otherwise we likely hit a segfault), and a master build of upstream libgd (otherwise the original image couldn't be allocated in the first place[1]). [1] <https://github.com/libgd/libgd/commit/c3cf674cb444696a36f720f785878b41225af063> Test script: --------------- <?php $img = imagecreate(2**28, 1); var_dump(imagescale($img, 1, 1, IMG_TRIANGLE)); Expected result: ---------------- Warning: imagescale(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully in %s on line %d bool(false) Actual result: -------------- Warning: imagescale(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully in %s on line %d resource(%d) of type (gd) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=77272&edit=1