Fix GH-17984: gd calls with array arguments.

php · Mar 6, 2025 · 8a8bd36 · 8a8bd36
1 parent 01c1dbb
commit 8a8bd36
Show file tree

Hide file tree

Showing 2 changed files with 47 additions and 3 deletions.
diff --git a/ext/gd/gd.c b/ext/gd/gd.c
@@ -3697,7 +3697,7 @@ PHP_FUNCTION(imageaffine)
 	}
 
 	for (i = 0; i < nelems; i++) {
-		if ((zval_affine_elem = zend_hash_index_find(Z_ARRVAL_P(z_affine), i)) != NULL) {
+		if ((zval_affine_elem = zend_hash_index_find_deref(Z_ARRVAL_P(z_affine), i)) != NULL) {
 			switch (Z_TYPE_P(zval_affine_elem)) {
 				case IS_LONG:
 					affine[i] = Z_LVAL_P(zval_affine_elem);
@@ -3873,7 +3873,7 @@ PHP_FUNCTION(imageaffinematrixconcat)
 	}
 
 	for (i = 0; i < 6; i++) {
-		if ((tmp = zend_hash_index_find(Z_ARRVAL_P(z_m1), i)) != NULL) {
+		if ((tmp = zend_hash_index_find_deref(Z_ARRVAL_P(z_m1), i)) != NULL) {
 			switch (Z_TYPE_P(tmp)) {
 				case IS_LONG:
 					m1[i]  = Z_LVAL_P(tmp);
@@ -3890,7 +3890,7 @@ PHP_FUNCTION(imageaffinematrixconcat)
 			}
 		}
 
-		if ((tmp = zend_hash_index_find(Z_ARRVAL_P(z_m2), i)) != NULL) {
+		if ((tmp = zend_hash_index_find_deref(Z_ARRVAL_P(z_m2), i)) != NULL) {
 			switch (Z_TYPE_P(tmp)) {
 				case IS_LONG:
 					m2[i]  = Z_LVAL_P(tmp);

diff --git a/ext/gd/tests/gh17984.phpt b/ext/gd/tests/gh17984.phpt
@@ -0,0 +1,44 @@
+--TEST--
+GH-17984: array of references handling
+--EXTENSIONS--
+gd
+--FILE--
+<?php
+$a = 0;
+$matrix = [&$a, 1, 1, 1, 1, 1];
+$subarray = [&$a, 0, 0];
+$matrix3 = array([0, 0, 0] , &$subarray, [0, 0, 0]);
+$src = imagecreatetruecolor(8, 8);
+var_dump(imageaffine($src, $matrix));
+var_dump(imageaffinematrixconcat($matrix, $matrix));
+var_dump(imageconvolution($src, $matrix3, 1.0, 0.0));
+$poly = imagecolorallocate($src, 255, 0, 0);
+var_dump(imagepolygon($src, array (
+        &$a,   0,
+        100, 200,
+        300, 200
+    ),
+    $poly));
+$style = [&$a, &$a];
+var_dump(imagesetstyle($src, $style)); 
+?>
+--EXPECT--
+object(GdImage)#2 (0) {
+}
+array(6) {
+  [0]=>
+  float(1)
+  [1]=>
+  float(1)
+  [2]=>
+  float(1)
+  [3]=>
+  float(2)
+  [4]=>
+  float(2)
+  [5]=>
+  float(3)
+}
+bool(true)
+bool(true)
+bool(true)