#32893 [NEW]: imagettftext crash

From: php at fiddaman dot net Operating system: Solaris 9 PHP version: 4.3.11 PHP Bug Type: Reproducible crash Bug description: imagettftext crash Description: ------------ PHP crashes in imagettftext - worked fine in 4.3.10 ./configure \ --prefix=/opt/php \ --with-exec-dir=/opt/php/bin \ --with-apxs2=/opt/apache/bin/apxs \ --enable-memory-limit \ --with-iconv \ --enable-ftp \ --enable-mbstring \ --with-mbstring=all \ --with-gettext \ --enable-calendar \ --with-mime-magic \ --with-mysql \ --with-mysqli=/opt/mysql/bin/mysql_config \ \ --with-openssl=/opt/openssl \ --with-mysql=/opt/mysql \ --with-gdbm=/opt/GNUgdbm \ --with-db4=/opt/newdb \ --with-dom=/opt/libxml2 \ --with-gmp=/opt/GNUmp \ --with-mcrypt=/opt/libmcrypt \ \ --with-imap=/opt/c-client \ --with-imap-ssl=/opt/openssl \ \ --with-zlib=/usr \ --with-zlib-dir=/usr \ --with-bz2=/usr \ \ --with-gd \ --with-jpeg-dir=/opt/libjpg \ --with-png-dir=/opt/libpng \ --with-freetype-dir=/opt/freetype Reproduce code: --------------- <?php $img = imagecreate(400, 70); $font_colour = imagecolorallocate($img, 0, 0x50, 0); imagettftext($img, 11/81*64, 0, 0, 27, "$font_colour", "/tmp/federation.ttf", "test"); imagedestroy($img); ?> Expected result: ---------------- No errors. Actual result: -------------- #0 0x00000001001a70b4 in zend_parse_va_args (num_args=4, type_spec=0x10023cd7b "lllss|a", va=0xffffffff7fffe898, flags=0) at /spool/src/build/php-4.3.11/Zend/zend_API.c:260 #1 0x00000001001a7b18 in zend_parse_parameters (num_args=8, type_spec=0x10023cd78 "rddlllss|a") at /spool/src/build/php-4.3.11/Zend/zend_API.c:552 #2 0x0000000100071a7c in php_imagettftext_common (ht=8, return_value=0x10061dd28, this_ptr=0x0, return_value_used=0, mode=0, extended=0) at /spool/src/build/php-4.3.11/ext/gd/gd.c:3042 #3 0x00000001001bb0c4 in execute (op_array=0x10063b2a8) at /spool/src/build/php-4.3.11/Zend/zend_execute.c:1654 #4 0x00000001001a64b0 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /spool/src/build/php-4.3.11/Zend/zend.c:926 #5 0x0000000100173ba0 in php_execute_script (primary_file=0xffffffff7ffffaa0) at /spool/src/build/php-4.3.11/main/main.c:1745 #6 0x00000001001c3f08 in main (argc=2, argv=0xffffffff7ffffb98) at /spool/src/build/php-4.3.11/sapi/cli/php_cli.c:828 -- Edit bug report at http://bugs.php.net/?id=32893&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=32893&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=32893&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=32893&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=32893&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=32893&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=32893&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=32893&r=needscript Try newer version: http://bugs.php.net/fix.php?id=32893&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=32893&r=support Expected behavior: http://bugs.php.net/fix.php?id=32893&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=32893&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=32893&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=32893&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=32893&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=32893&r=dst IIS Stability: http://bugs.php.net/fix.php?id=32893&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=32893&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=32893&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=32893&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=32893&r=mysqlcfg