Skip to content

Commit 4488475

Browse files
nikicnikic
committed
imagecolorallocate(): Check that RGB components are in-range
Instead of letting them bleed over into other components.
1 parent 117c7b3 commit 4488475

File tree

3 files changed

+92
-15
lines changed

3 files changed

+92
-15
lines changed

‎ext/gd/gd.c

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1817,6 +1817,12 @@ PHP_FUNCTION(imagelayereffect)
18171817
}
18181818
/* }}} */
18191819

1820+
#define CHECK_RGB_RANGE(component, name) \
1821+
if (component < 0 || component > 255) { \
1822+
php_error_docref(NULL, E_WARNING, #name " component is out of range"); \
1823+
RETURN_FALSE; \
1824+
}
1825+
18201826
/* {{{ proto int imagecolorallocatealpha(resource im, int red, int green, int blue, int alpha)
18211827
Allocate a color with an alpha level. Works for true color and palette based images */
18221828
PHP_FUNCTION(imagecolorallocatealpha)
@@ -1834,6 +1840,10 @@ PHP_FUNCTION(imagecolorallocatealpha)
18341840
RETURN_FALSE;
18351841
}
18361842

1843+
CHECK_RGB_RANGE(red, Red);
1844+
CHECK_RGB_RANGE(green, Green);
1845+
CHECK_RGB_RANGE(blue, Blue);
1846+
18371847
ct = gdImageColorAllocateAlpha(im, red, green, blue, alpha);
18381848
if (ct < 0) {
18391849
RETURN_FALSE;
@@ -2809,7 +2819,6 @@ PHP_FUNCTION(imagedestroy)
28092819
}
28102820
/* }}} */
28112821

2812-
28132822
/* {{{ proto int imagecolorallocate(resource im, int red, int green, int blue)
28142823
Allocate a color for an image */
28152824
PHP_FUNCTION(imagecolorallocate)
@@ -2827,6 +2836,10 @@ PHP_FUNCTION(imagecolorallocate)
28272836
RETURN_FALSE;
28282837
}
28292838

2839+
CHECK_RGB_RANGE(red, Red);
2840+
CHECK_RGB_RANGE(green, Green);
2841+
CHECK_RGB_RANGE(blue, Blue);
2842+
28302843
ct = gdImageColorAllocate(im, red, green, blue);
28312844
if (ct < 0) {
28322845
RETURN_FALSE;

‎ext/gd/tests/imagecolorallocate_variation5.phpt

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ foreach($values as $key => $value) {
4545
};
4646
?>
4747
===DONE===
48-
--EXPECT--
48+
--EXPECTF--
4949
*** Testing imagecolorallocate() : usage variations ***
5050

5151
--Octal 000--
@@ -59,9 +59,15 @@ int(657930)
5959
int(657930)
6060

6161
--Octal -012--
62+
63+
Warning: imagecolorallocate(): Red component is out of range in %s on line %d
64+
bool(false)
65+
66+
Warning: imagecolorallocate(): Green component is out of range in %s on line %d
67+
bool(false)
68+
69+
Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
6270
bool(false)
63-
int(652810)
64-
int(657910)
6571

6672
--Octal 0377--
6773
int(16714250)
@@ -79,9 +85,15 @@ int(657930)
7985
int(657930)
8086

8187
--Hexa-decimal -0xA--
88+
89+
Warning: imagecolorallocate(): Red component is out of range in %s on line %d
90+
bool(false)
91+
92+
Warning: imagecolorallocate(): Green component is out of range in %s on line %d
93+
bool(false)
94+
95+
Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
8296
bool(false)
83-
int(652810)
84-
int(657910)
8597

8698
--Hexa-decimal 0xFF--
8799
int(16714250)

‎ext/gd/tests/imagecolorallocate_variation6.phpt

Lines changed: 61 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -34,23 +34,75 @@ foreach($values as $key => $value) {
3434
//Need to be created every time to get expected return value
3535
$im_palette = imagecreate(200, 200);
3636
$im_true_color = imagecreatetruecolor(200, 200);
37-
var_dump( imagecolorallocate($im_palette, $value, $value, $value) );
38-
var_dump( imagecolorallocate($im_true_color, $value, $value, $value) );
37+
var_dump( imagecolorallocate($im_palette, $value, 0, 0) );
38+
var_dump( imagecolorallocate($im_true_color, $value, 0, 0) );
39+
var_dump( imagecolorallocate($im_palette, 0, $value, 0) );
40+
var_dump( imagecolorallocate($im_true_color, 0, $value, 0) );
41+
var_dump( imagecolorallocate($im_palette, 0, 0, $value) );
42+
var_dump( imagecolorallocate($im_true_color, 0, 0, $value) );
3943
};
4044
?>
4145
===DONE===
42-
--EXPECT--
46+
--EXPECTF--
4347
*** Testing imagecolorallocate() : usage variations ***
4448

4549
--Decimal 256--
46-
int(0)
47-
int(16843008)
50+
51+
Warning: imagecolorallocate(): Red component is out of range in %s on line %d
52+
bool(false)
53+
54+
Warning: imagecolorallocate(): Red component is out of range in %s on line %d
55+
bool(false)
56+
57+
Warning: imagecolorallocate(): Green component is out of range in %s on line %d
58+
bool(false)
59+
60+
Warning: imagecolorallocate(): Green component is out of range in %s on line %d
61+
bool(false)
62+
63+
Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
64+
bool(false)
65+
66+
Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
67+
bool(false)
4868

4969
--Octal 0400--
50-
int(0)
51-
int(16843008)
70+
71+
Warning: imagecolorallocate(): Red component is out of range in %s on line %d
72+
bool(false)
73+
74+
Warning: imagecolorallocate(): Red component is out of range in %s on line %d
75+
bool(false)
76+
77+
Warning: imagecolorallocate(): Green component is out of range in %s on line %d
78+
bool(false)
79+
80+
Warning: imagecolorallocate(): Green component is out of range in %s on line %d
81+
bool(false)
82+
83+
Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
84+
bool(false)
85+
86+
Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
87+
bool(false)
5288

5389
--Hexa-decimal 0x100--
54-
int(0)
55-
int(16843008)
90+
91+
Warning: imagecolorallocate(): Red component is out of range in %s on line %d
92+
bool(false)
93+
94+
Warning: imagecolorallocate(): Red component is out of range in %s on line %d
95+
bool(false)
96+
97+
Warning: imagecolorallocate(): Green component is out of range in %s on line %d
98+
bool(false)
99+
100+
Warning: imagecolorallocate(): Green component is out of range in %s on line %d
101+
bool(false)
102+
103+
Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
104+
bool(false)
105+
106+
Warning: imagecolorallocate(): Blue component is out of range in %s on line %d
107+
bool(false)
56108
===DONE===

0 commit comments

Comments
 (0)