php-src/ext/gd/tests/bug66356.phpt at 0f3e741b538eefb1d1ffa42dc7b13d6ecf6db660 · php/php-src · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
--TEST--
Bug #66356 (Heap Overflow Vulnerability in imagecrop())
--EXTENSIONS--
gd
--FILE--
<?php
$img = imagecreatetruecolor(10, 10);

// POC #1
var_dump(imagecrop($img, array("x" => 0, "y" => 0, "width" => 10, "height" => 10)));

$arr = array("x" => 2147483647, "y" => 2147483647, "width" => 10, "height" => 10);
try {
	imagecrop($img, $arr);
} catch (\ValueError $e) {
	echo $e->getMessage() . PHP_EOL;
}
print_r($arr);

// POC #2
var_dump(imagecrop($img, array("x" => 0, "y" => 0, "width" => -1, "height" => 10)));

// POC #3
var_dump(imagecrop($img, array("x" => -20, "y" => -20, "width" => 10, "height" => 10)));

// POC #4
var_dump(imagecrop($img, array("x" => 0x7fffff00, "y" => 0, "width" => 10, "height" => 10)));

// bug 66815
var_dump(imagecrop($img, array("x" => 0, "y" => 0, "width" => 65535, "height" => 65535)));
?>
--EXPECTF--
object(GdImage)#2 (0) {
}
imagecrop(): Argument #2 ($rectangle) overflow with "x" and "width" keys
Array
(
    [x] => 2147483647
    [y] => 2147483647
    [width] => 10
    [height] => 10
)

Warning: imagecrop(): %cne parameter to a memory allocation multiplication is negative or zero, failing operation gracefully
 in %s on line %d
bool(false)
object(GdImage)#3 (0) {
}
object(GdImage)#3 (0) {
}

Warning: imagecrop(): %croduct of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
 in %s on line %d
bool(false)