[security] Bug #73957: signed integer conversion in imagescale()

paulbiss · paulbiss · commit 5d0afa03d246 · 2018-05-01T19:15:29.000-07:00
diff --git a/hphp/runtime/ext/gd/ext_gd.cpp b/hphp/runtime/ext/gd/ext_gd.cpp
@@ -4408,7 +4408,7 @@ Variant HHVM_FUNCTION(imagescale, const Resource& image, int64_t newwidth,
       newheight = newwidth * src_y / src_x;
     }
   }
-  if (newheight <= 0 || newwidth <= 0) {
+  if (newheight <= 0 || newheight > INT_MAX || newwidth <= 0 || newwidth > INT_MAX) {
     return false;
   }
 
diff --git a/hphp/test/zend/good/ext/gd/tests/bug73957.php b/hphp/test/zend/good/ext/gd/tests/bug73957.php
@@ -0,0 +1,9 @@
+<?php
+$im = imagecreate(8, 8);
+$im = imagescale($im, 0x100000001, 1);
+var_dump($im);
+if ($im) { // which is not supposed to happen
+    var_dump(imagesx($im));
+}
+?>
+
diff --git a/hphp/test/zend/good/ext/gd/tests/bug73957.php.expectf b/hphp/test/zend/good/ext/gd/tests/bug73957.php.expectf
@@ -0,0 +1 @@
+bool(false)
diff --git a/hphp/test/zend/good/ext/gd/tests/bug73957.php.skipif b/hphp/test/zend/good/ext/gd/tests/bug73957.php.skipif
@@ -0,0 +1,4 @@
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (PHP_INT_SIZE != 8) die('skip this test is for 64bit platforms only');
+?>
