Skip to content

Commit 8a8bd36

Browse files
committed
Fix GH-17984: gd calls with array arguments.
1 parent 01c1dbb commit 8a8bd36

File tree

2 files changed

+47
-3
lines changed

2 files changed

+47
-3
lines changed

ext/gd/gd.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3697,7 +3697,7 @@ PHP_FUNCTION(imageaffine)
36973697
}
36983698

36993699
for (i = 0; i < nelems; i++) {
3700-
if ((zval_affine_elem = zend_hash_index_find(Z_ARRVAL_P(z_affine), i)) != NULL) {
3700+
if ((zval_affine_elem = zend_hash_index_find_deref(Z_ARRVAL_P(z_affine), i)) != NULL) {
37013701
switch (Z_TYPE_P(zval_affine_elem)) {
37023702
case IS_LONG:
37033703
affine[i] = Z_LVAL_P(zval_affine_elem);
@@ -3873,7 +3873,7 @@ PHP_FUNCTION(imageaffinematrixconcat)
38733873
}
38743874

38753875
for (i = 0; i < 6; i++) {
3876-
if ((tmp = zend_hash_index_find(Z_ARRVAL_P(z_m1), i)) != NULL) {
3876+
if ((tmp = zend_hash_index_find_deref(Z_ARRVAL_P(z_m1), i)) != NULL) {
38773877
switch (Z_TYPE_P(tmp)) {
38783878
case IS_LONG:
38793879
m1[i] = Z_LVAL_P(tmp);
@@ -3890,7 +3890,7 @@ PHP_FUNCTION(imageaffinematrixconcat)
38903890
}
38913891
}
38923892

3893-
if ((tmp = zend_hash_index_find(Z_ARRVAL_P(z_m2), i)) != NULL) {
3893+
if ((tmp = zend_hash_index_find_deref(Z_ARRVAL_P(z_m2), i)) != NULL) {
38943894
switch (Z_TYPE_P(tmp)) {
38953895
case IS_LONG:
38963896
m2[i] = Z_LVAL_P(tmp);

ext/gd/tests/gh17984.phpt

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
--TEST--
2+
GH-17984: array of references handling
3+
--EXTENSIONS--
4+
gd
5+
--FILE--
6+
<?php
7+
$a = 0;
8+
$matrix = [&$a, 1, 1, 1, 1, 1];
9+
$subarray = [&$a, 0, 0];
10+
$matrix3 = array([0, 0, 0] , &$subarray, [0, 0, 0]);
11+
$src = imagecreatetruecolor(8, 8);
12+
var_dump(imageaffine($src, $matrix));
13+
var_dump(imageaffinematrixconcat($matrix, $matrix));
14+
var_dump(imageconvolution($src, $matrix3, 1.0, 0.0));
15+
$poly = imagecolorallocate($src, 255, 0, 0);
16+
var_dump(imagepolygon($src, array (
17+
&$a, 0,
18+
100, 200,
19+
300, 200
20+
),
21+
$poly));
22+
$style = [&$a, &$a];
23+
var_dump(imagesetstyle($src, $style));
24+
?>
25+
--EXPECT--
26+
object(GdImage)#2 (0) {
27+
}
28+
array(6) {
29+
[0]=>
30+
float(1)
31+
[1]=>
32+
float(1)
33+
[2]=>
34+
float(1)
35+
[3]=>
36+
float(2)
37+
[4]=>
38+
float(2)
39+
[5]=>
40+
float(3)
41+
}
42+
bool(true)
43+
bool(true)
44+
bool(true)

0 commit comments

Comments
 (0)