mirror of
https://github.com/php/php-src.git
synced 2024-09-22 02:17:32 +00:00
imagepolygon() and imagefilledpolygon() does not allow negative number of points causing invalid allocation
This commit is contained in:
parent
fef4bf8a9d
commit
f7a3b3f5aa
@ -3427,7 +3427,10 @@ static void php_imagepolygon(INTERNAL_FUNCTION_PARAMETERS, int filled)
|
||||
php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must have at least 3 points in your array");
|
||||
RETURN_FALSE;
|
||||
}
|
||||
|
||||
if (npoints <= 0) {
|
||||
php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must give a positive number of points");
|
||||
RETURN_FALSE;
|
||||
}
|
||||
if (nelem < npoints * 2) {
|
||||
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Trying to use %d points in array with only %d points", npoints, nelem/2);
|
||||
RETURN_FALSE;
|
||||
|
@ -2568,7 +2568,7 @@ void gdImagePolygon (gdImagePtr im, gdPointPtr p, int n, int c)
|
||||
typedef void (*image_line)(gdImagePtr im, int x1, int y1, int x2, int y2, int color);
|
||||
image_line draw_line;
|
||||
|
||||
if (!n) {
|
||||
if (n <= 0) {
|
||||
return;
|
||||
}
|
||||
|
||||
@ -2621,7 +2621,7 @@ void gdImageFilledPolygon (gdImagePtr im, gdPointPtr p, int n, int c)
|
||||
int ints;
|
||||
int fill_color;
|
||||
|
||||
if (!n) {
|
||||
if (n <= 0) {
|
||||
return;
|
||||
}
|
||||
|
||||
|
15
ext/gd/tests/imagefilledpolygon_negative.phpt
Normal file
15
ext/gd/tests/imagefilledpolygon_negative.phpt
Normal file
@ -0,0 +1,15 @@
|
||||
--TEST--
|
||||
imagefilledpolygon() with a negative num of points
|
||||
--SKIPIF--
|
||||
<?php
|
||||
if (!function_exists('imagefilledpolygon')) die('skip imagefilledpolygon() not available');
|
||||
?>
|
||||
--FILE--
|
||||
<?php
|
||||
$im = imagecreate(100, 100);
|
||||
$black = imagecolorallocate($im, 0, 0, 0);
|
||||
if (imagefilledpolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
|
||||
imagedestroy($im);
|
||||
?>
|
||||
--EXPECTF--
|
||||
Warning: imagefilledpolygon(): You must give a positive number of points in %s on line %d
|
15
ext/gd/tests/imagepolygon_negative.phpt
Normal file
15
ext/gd/tests/imagepolygon_negative.phpt
Normal file
@ -0,0 +1,15 @@
|
||||
--TEST--
|
||||
imagepolygon() with a negative num of points
|
||||
--SKIPIF--
|
||||
<?php
|
||||
if (!function_exists('imagepolygon')) die('skip imagepolygon() not available');
|
||||
?>
|
||||
--FILE--
|
||||
<?php
|
||||
$im = imagecreate(100, 100);
|
||||
$black = imagecolorallocate($im, 0, 0, 0);
|
||||
if (imagepolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
|
||||
imagedestroy($im);
|
||||
?>
|
||||
--EXPECTF--
|
||||
Warning: imagepolygon(): You must give a positive number of points in %s on line %d
|
Loading…
Reference in New Issue
Block a user