[php-src] PR #24444: ext/gd: keep the brush and tile images alive while the destination uses them

From: Date: Mon, 19 Oct 2026 18:32:22 +0000
Subject: [php-src] PR #24444: ext/gd: keep the brush and tile images alive while the destination uses them
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39608@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24444 Author: lacatoire imagesetbrush() and imagesettile() store a raw pointer to the brush or tile image in libgd, but the destination GdImage keeps no reference to it. Once the brush object is released, drawing with IMG_COLOR_BRUSHED or IMG_COLOR_TILED reads freed memory. Keep a reference to both images in the destination object and expose them to the GC. ### To reproduce ```php <?php $im = imagecreatetruecolor(20, 20); $brush = imagecreatetruecolor(4, 4); imagefill($brush, 0, 0, 0xff0000); imagesetbrush($im, $brush); unset($brush); $junk = []; for ($i = 0; $i < 50; $i++) { $j = imagecreatetruecolor(4, 4); imagefill($j, 0, 0, 0x00ff00); $junk[] = $j; } imageline($im, 2, 10, 17, 10, IMG_COLOR_BRUSHED); printf("%06x\n", imagecolorat($im, 5, 10)); ``` php repro.php on PHP 8.5.4 Before: 00ff00, the pixels of another image After: ff0000

« previous php.git-pulls (#39608) next »