[php-src] PR #24444: ext/gd: keep the brush and tile images alive while the destination uses them
| From: | lacatoire | Date: | Mon, 19 Oct 2026 18:32:22 +0000 |
| Subject: | [php-src] PR #24444: ext/gd: keep the brush and tile images alive while the destination uses them | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39608@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24444
Author: lacatoire
imagesetbrush() and imagesettile() store a raw pointer to the brush or
tile image in libgd, but the destination GdImage keeps no reference to it. Once the
brush object is released, drawing with IMG_COLOR_BRUSHED or
IMG_COLOR_TILED reads freed memory. Keep a reference to both images in the destination
object and expose them to the GC.
### To reproduce
```php
<?php
$im = imagecreatetruecolor(20, 20);
$brush = imagecreatetruecolor(4, 4);
imagefill($brush, 0, 0, 0xff0000);
imagesetbrush($im, $brush);
unset($brush);
$junk = [];
for ($i = 0; $i < 50; $i++) { $j = imagecreatetruecolor(4, 4); imagefill($j, 0, 0, 0x00ff00);
$junk[] = $j; }
imageline($im, 2, 10, 17, 10, IMG_COLOR_BRUSHED);
printf("%06x\n", imagecolorat($im, 5, 10));
```
php repro.php on PHP 8.5.4
Before: 00ff00, the pixels of another image
After: ff0000