From 79b29f199402b5f6175b9e8d1895b2dc41a5cd11 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Mon, 31 Mar 2025 20:37:31 +0100 Subject: [PATCH 1/4] ext/gd: imageaffinematrixget() strengthening `options` type check. to be also more in line with other imageaffine* calls. --- ext/gd/gd.c | 37 +++++++++++++--- ext/gd/tests/imageaffinematrixget_errors.phpt | 43 +++++++++++++++++++ 2 files changed, 75 insertions(+), 5 deletions(-) create mode 100644 ext/gd/tests/imageaffinematrixget_errors.phpt diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 5822c368e3de2..fd290a43e2943 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -4138,15 +4138,33 @@ PHP_FUNCTION(imageaffinematrixget) RETURN_THROWS(); } - if ((tmp = zend_hash_str_find(Z_ARRVAL_P(options), "x", sizeof("x") - 1)) != NULL) { - x = zval_get_double(tmp); + if ((tmp = zend_hash_str_find_deref(Z_ARRVAL_P(options), "x", sizeof("x") - 1)) != NULL) { + switch (Z_TYPE_P(tmp)) { + case IS_LONG: + case IS_DOUBLE: + case IS_STRING: + x = zval_get_double(tmp); + break; + default: + zend_argument_type_error(2, "must be a float for the \"x\" key, %s given", zend_zval_value_name(tmp)); + RETURN_THROWS(); + } } else { zend_argument_value_error(2, "must have an \"x\" key"); RETURN_THROWS(); } - if ((tmp = zend_hash_str_find(Z_ARRVAL_P(options), "y", sizeof("y") - 1)) != NULL) { - y = zval_get_double(tmp); + if ((tmp = zend_hash_str_find_deref(Z_ARRVAL_P(options), "y", sizeof("y") - 1)) != NULL) { + switch (Z_TYPE_P(tmp)) { + case IS_LONG: + case IS_DOUBLE: + case IS_STRING: + y = zval_get_double(tmp); + break; + default: + zend_argument_type_error(2, "must be a float for the \"y\" key, %s given", zend_zval_value_name(tmp)); + RETURN_THROWS(); + } } else { zend_argument_value_error(2, "must have a \"y\" key"); RETURN_THROWS(); @@ -4165,7 +4183,16 @@ PHP_FUNCTION(imageaffinematrixget) case GD_AFFINE_SHEAR_VERTICAL: { double angle; - angle = zval_get_double(options); + switch (Z_TYPE_P(options)) { + case IS_LONG: + case IS_DOUBLE: + case IS_STRING: + angle = zval_get_double(options); + break; + default: + zend_argument_type_error(2, "must be of type float, %s given", zend_zval_value_name(options)); + RETURN_THROWS(); + } if (type == GD_AFFINE_SHEAR_HORIZONTAL) { res = gdAffineShearHorizontal(affine, angle); diff --git a/ext/gd/tests/imageaffinematrixget_errors.phpt b/ext/gd/tests/imageaffinematrixget_errors.phpt new file mode 100644 index 0000000000000..5c35596a74f74 --- /dev/null +++ b/ext/gd/tests/imageaffinematrixget_errors.phpt @@ -0,0 +1,43 @@ +--TEST-- +imageaffinematrixget +--EXTENSIONS-- +gd +--FILE-- +getMessage(), PHP_EOL; +} +try { + imageaffinematrixget(IMG_AFFINE_SCALE, ["x" => new A(), "y" => 1]); +} catch (\TypeError $e) { + echo $e->getMessage(), PHP_EOL; +} +try { + imageaffinematrixget(IMG_AFFINE_SCALE, ["x" => 10, "y" => new A()]); +} catch (\TypeError $e) { + echo $e->getMessage(), PHP_EOL; +} +var_dump(imageaffinematrixget(IMG_AFFINE_SCALE, ["x" => &$a, "y" => &$a])); +?> +--EXPECT-- +imageaffinematrixget(): Argument #2 ($options) must be of type float, A given +imageaffinematrixget(): Argument #2 ($options) must be a float for the "x" key, A given +imageaffinematrixget(): Argument #2 ($options) must be a float for the "y" key, A given +array(6) { + [0]=> + float(10) + [1]=> + float(0) + [2]=> + float(0) + [3]=> + float(10) + [4]=> + float(0) + [5]=> + float(0) +} From 96dbe843990a802267febb2bed6606432ea6a8bf Mon Sep 17 00:00:00 2001 From: David Carlier Date: Mon, 31 Mar 2025 21:28:20 +0100 Subject: [PATCH 2/4] update existing test --- ext/gd/tests/bug67248.phpt | 51 +++----------------------------------- 1 file changed, 3 insertions(+), 48 deletions(-) diff --git a/ext/gd/tests/bug67248.phpt b/ext/gd/tests/bug67248.phpt index a002f71c7fd35..83009e35bff22 100644 --- a/ext/gd/tests/bug67248.phpt +++ b/ext/gd/tests/bug67248.phpt @@ -19,53 +19,8 @@ for($i=0;$i<7;$i++) { --EXPECTF-- !! [TypeError] imageaffinematrixget(): Argument #1 ($type) must be of type array when using translate or scale !! [TypeError] imageaffinematrixget(): Argument #1 ($type) must be of type array when using translate or scale - -Warning: Object of class stdClass could not be converted to float in %s on line %d -array(6) { - [0]=> - float(%f) - [1]=> - float(%f) - [2]=> - float(%f) - [3]=> - float(%f) - [4]=> - float(0) - [5]=> - float(0) -} - -Warning: Object of class stdClass could not be converted to float in %s on line %d -array(6) { - [0]=> - float(1) - [1]=> - float(0) - [2]=> - float(%f) - [3]=> - float(1) - [4]=> - float(0) - [5]=> - float(0) -} - -Warning: Object of class stdClass could not be converted to float in %s on line %d -array(6) { - [0]=> - float(1) - [1]=> - float(%f) - [2]=> - float(0) - [3]=> - float(1) - [4]=> - float(0) - [5]=> - float(0) -} +!! [TypeError] imageaffinematrixget(): Argument #2 ($options) must be of type float, stdClass given +!! [TypeError] imageaffinematrixget(): Argument #2 ($options) must be of type float, stdClass given +!! [TypeError] imageaffinematrixget(): Argument #2 ($options) must be of type float, stdClass given !! [ValueError] imageaffinematrixget(): Argument #1 ($type) must be a valid element type !! [ValueError] imageaffinematrixget(): Argument #1 ($type) must be a valid element type From a3202a2a0783f34ea578d3d951fbc692a3847f46 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Tue, 1 Apr 2025 22:41:53 +0100 Subject: [PATCH 3/4] support possible compatible objects --- ext/gd/gd.c | 3 +++ ext/gd/tests/imageaffinematrixget_errors.phpt | 11 +++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/ext/gd/gd.c b/ext/gd/gd.c index fd290a43e2943..12ffff61c0d60 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -4143,6 +4143,7 @@ PHP_FUNCTION(imageaffinematrixget) case IS_LONG: case IS_DOUBLE: case IS_STRING: + case IS_OBJECT: x = zval_get_double(tmp); break; default: @@ -4159,6 +4160,7 @@ PHP_FUNCTION(imageaffinematrixget) case IS_LONG: case IS_DOUBLE: case IS_STRING: + case IS_OBJECT: y = zval_get_double(tmp); break; default: @@ -4187,6 +4189,7 @@ PHP_FUNCTION(imageaffinematrixget) case IS_LONG: case IS_DOUBLE: case IS_STRING: + case IS_OBJECT: angle = zval_get_double(options); break; default: diff --git a/ext/gd/tests/imageaffinematrixget_errors.phpt b/ext/gd/tests/imageaffinematrixget_errors.phpt index 5c35596a74f74..2ad6190f8f4b6 100644 --- a/ext/gd/tests/imageaffinematrixget_errors.phpt +++ b/ext/gd/tests/imageaffinematrixget_errors.phpt @@ -23,10 +23,13 @@ try { } var_dump(imageaffinematrixget(IMG_AFFINE_SCALE, ["x" => &$a, "y" => &$a])); ?> ---EXPECT-- -imageaffinematrixget(): Argument #2 ($options) must be of type float, A given -imageaffinematrixget(): Argument #2 ($options) must be a float for the "x" key, A given -imageaffinematrixget(): Argument #2 ($options) must be a float for the "y" key, A given +--EXPECTF-- + +Warning: Object of class A could not be converted to float in %s on line %d + +Warning: Object of class A could not be converted to float in %s on line %d + +Warning: Object of class A could not be converted to float in %s on line %d array(6) { [0]=> float(10) From 0ccf60ef7b228682121936d50f133f45c8c498a0 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Tue, 1 Apr 2025 23:23:05 +0100 Subject: [PATCH 4/4] fix test --- ext/gd/tests/bug67248.phpt | 51 +++++++++++++++++++++++++++++++++++--- 1 file changed, 48 insertions(+), 3 deletions(-) diff --git a/ext/gd/tests/bug67248.phpt b/ext/gd/tests/bug67248.phpt index 83009e35bff22..a002f71c7fd35 100644 --- a/ext/gd/tests/bug67248.phpt +++ b/ext/gd/tests/bug67248.phpt @@ -19,8 +19,53 @@ for($i=0;$i<7;$i++) { --EXPECTF-- !! [TypeError] imageaffinematrixget(): Argument #1 ($type) must be of type array when using translate or scale !! [TypeError] imageaffinematrixget(): Argument #1 ($type) must be of type array when using translate or scale -!! [TypeError] imageaffinematrixget(): Argument #2 ($options) must be of type float, stdClass given -!! [TypeError] imageaffinematrixget(): Argument #2 ($options) must be of type float, stdClass given -!! [TypeError] imageaffinematrixget(): Argument #2 ($options) must be of type float, stdClass given + +Warning: Object of class stdClass could not be converted to float in %s on line %d +array(6) { + [0]=> + float(%f) + [1]=> + float(%f) + [2]=> + float(%f) + [3]=> + float(%f) + [4]=> + float(0) + [5]=> + float(0) +} + +Warning: Object of class stdClass could not be converted to float in %s on line %d +array(6) { + [0]=> + float(1) + [1]=> + float(0) + [2]=> + float(%f) + [3]=> + float(1) + [4]=> + float(0) + [5]=> + float(0) +} + +Warning: Object of class stdClass could not be converted to float in %s on line %d +array(6) { + [0]=> + float(1) + [1]=> + float(%f) + [2]=> + float(0) + [3]=> + float(1) + [4]=> + float(0) + [5]=> + float(0) +} !! [ValueError] imageaffinematrixget(): Argument #1 ($type) must be a valid element type !! [ValueError] imageaffinematrixget(): Argument #1 ($type) must be a valid element type