[php-src] PR #25293: ext/standard: Reject out-of-range XBM dimensions
| From: | iliaal | Date: | Sat, 07 Nov 2026 17:13:02 +0000 |
| Subject: | [php-src] PR #25293: ext/standard: Reject out-of-range XBM dimensions | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40406@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25293
Author: iliaal
An XBM file declaring
#define x_width 4294967298 makes getimagesize() report a width of
2 and imagecreatefromxbm() return a 2-pixel image, because both readers parse the dimension with
sscanf("%d") and that overflow is undefined; negative values come back as huge unsigned
sizes. This parses the value with strtol(), accepts only 1 to INT_MAX in both readers, and checks
the bundled GD byte count against INT_MAX before multiplying.