Unexpected value in ext/gd/libgd/gd_interpolation.c:2443

[YuanchengJiang]

Description

The following code:

<?php
$matrix = [PHP_INT_MAX, 1, 1, 1, 1, 1];
$src = imagecreatetruecolor(8, 8);
var_dump(imageaffine($src, $matrix));

Resulted in this output:

/php-src/ext/gd/libgd/gd_interpolation.c:2443:17: runtime error: 7.3787e+19 is outside the range of representable values of type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/gd/libgd/gd_interpolation.c:2443:17 in

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[cmb69]

There has been a recent change to gd_interpolation.c, so I think this now about:

php-src/ext/gd/libgd/gd_interpolation.c

Line 2461 in f2fbb75

bbox->width = (int) floor(max.x - min.x) - 1;

An option might be to clamp the value to fit into int, but the result should be checked. Maybe we just need to reject very large (and very small) values for the affine matrix components.

Upstream libgd might have the same issue:

https://github.com/libgd/libgd/blob/6e42ee80eb3bcf840c9fc03c6adc0550c1e02c63/src/gd_interpolation.c#L2205C2-L2205C45

Likely not relevant to this issue, but still something we may want to backport is libgd/libgd@b30fdbf; however, there was a follow up (libgd/libgd@3f50ffa) which changed that again.

[cmb69]

This ticket has been closed accidentially.