ext/gd: imagefilter* using overflow checks. (#18283)

devnexen · web-flow · commit 2e7df9e4238f · 2025-04-19T16:27:14.000+01:00
Accept up to UINT_MAX * sizeof(int) colors.
diff --git a/ext/gd/gd.c b/ext/gd/gd.c
@@ -3599,7 +3599,7 @@ static void php_image_filter_scatter(INTERNAL_FUNCTION_PARAMETERS)
 			RETURN_BOOL(gdImageScatter(im, (int)scatter_sub, (int)scatter_plus));
 		}
 
-		colors = emalloc(num_colors * sizeof(int));
+		colors = safe_emalloc(num_colors, sizeof(int), 0);
 
 		ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(hash_colors), color) {
 			*(colors + i++) = (int) zval_get_long(color);

Original file line number	Diff line number	Diff line change
`@@ -3599,7 +3599,7 @@ static void php_image_filter_scatter(INTERNAL_FUNCTION_PARAMETERS)`
`3599`	`3599`	`RETURN_BOOL(gdImageScatter(im, (int)scatter_sub, (int)scatter_plus));`
`3600`	`3600`	`}`
`3601`	`3601`
`3602`		`- colors = emalloc(num_colors * sizeof(int));`
	`3602`	`+ colors = safe_emalloc(num_colors, sizeof(int), 0);`
`3603`	`3603`
`3604`	`3604`	`ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(hash_colors), color) {`
`3605`	`3605`	`*(colors + i++) = (int) zval_get_long(color);`