`imagecopyresampled()` silently copies nothing when given negative source width/height (regression in 8.6 after GD 2.4 sync)

Offen
  • Stimmt etwas nicht?
#25,175 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
48/100
Issue-Typ
Bug
Klarheit
Größtenteils klar
Aktivitätsstatus
Aktiv
Tech-Stack
c, php
Bereich
computer-graphics

Rechercherichtung

Reproduce the reported flips with the supplied PHP script, then read PHP_FUNCTION(imagecopyresampled) in ext/gd/gd.c and gdImageClipCopyResized() in ext/gd/libgd/gd_intern.h. The issue leaves open whether negative dimensions should remain supported or be deprecated and rejected, so clarify that expected behavior before changing code. Done means the chosen behavior is covered by regression tests and no longer silently leaves the destination blank.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Bug Status: Needs Triage
Description

The following code:

<?php
$w = 100;
$h = 100;

$src = imagecreatetruecolor($w, $h);
imagefilledrectangle($src, 0, 0, $w - 1, $h - 1, imagecolorallocate($src, 0, 0, 255)); // blue
imagefilledrectangle($src, 0, 0, 9, 9, imagecolorallocate($src, 255, 0, 0));            // red top-left corner

$cases = [
    'horizontal flip (negative src_width)' => [$w - 1, 0, -$w, $h],
    'vertical flip (negative src_height)'  => [0, $h - 1, $w, -$h],
    'both (negative src_width/src_height)' => [$w - 1, $h - 1, -$w, -$h],
];

foreach ($cases as $label => [$src_x, $src_y, $src_w, $src_h]) {
    $dst = imagecreatetruecolor($w, $h);
    $ret = imagecopyresampled($dst, $src, 0, 0, $src_x, $src_y, $w, $h, $src_w, $src_h);
    printf(
        "%s: return=%s top-left=%06x top-right=%06x bottom-left=%06x bottom-right=%06x\n",
        $label,
        var_export($ret, true),
        imagecolorat($dst, 0, 0),
        imagecolorat($dst, $w - 1, 0),
        imagecolorat($dst, 0, $h - 1),
        imagecolorat($dst, $w - 1, $h - 1)
    );
}

Resulted in this output:

horizontal flip (negative src_width): return=true top-left=000000 top-right=000000 bottom-left=000000 bottom-right=000000
vertical flip (negative src_height): return=true top-left=000000 top-right=000000 bottom-left=000000 bottom-right=000000
both (negative src_width/src_height): return=true top-left=000000 top-right=000000 bottom-left=000000 bottom-right=000000

But I expected this output instead:

horizontal flip (negative src_width): return=true top-left=0000ff top-right=ff0000 bottom-left=0000ff bottom-right=0000ff
vertical flip (negative src_height): return=true top-left=0000ff top-right=0000ff bottom-left=ff0000 bottom-right=0000ff
both (negative src_width/src_height): return=true top-left=0000ff top-right=0000ff bottom-left=0000ff bottom-right=ff0000
Additional context

The output above is from PHP 8.6.0RC4 (gd_info()['GD Version']: bundled (2.4.0 compatible)). The expected output is the actual output of the same script on PHP 8.5.12 (bundled (2.1.0 compatible)).

Since the bundled libgd was synced to 2.4 (GH-22532), imagecopyresampled() no longer copies anything when $src_width or $src_height is negative. It still returns true, so the destination image is left as the blank (black) canvas from imagecreatetruecolor(), and the caller gets no warning or error. Calls with positive dimensions are unaffected: copying the same image with 0, 0, 100, 100 as the source area produces identical output on 8.5 and 8.6.

Passing a negative source width/height with $src_x/$src_y set to the opposite edge "has worked as a way to mirror/flip an image in several PHP releases prior to 8.6 (verified on 7.4, 8.0, 8.4, and 8.5). It was widely used before imageflip() was added in PHP 5.5 and is still in use today.

For example, WordPress core's GD image editor uses it to implement flipping (WP_Image_Editor_GD::flip()). On PHP 8.6 every flipped image comes out solid black. WordPress has flipped images this way since late 2009 and was first shipped in WordPress 2.9, which defined a minimum PHP version of 4.3.

A related report was created for WordPress' own tracking purposes on Trac.

Possible Cause

This appears to be caused by the new gdImageClipCopyResized() helper in ext/gd/libgd/gd_intern.h, which gdImageCopyResampled() now calls before copying any pixels:

if (*dstW <= 0 || *dstH <= 0 || *srcW <= 0 || *srcH <= 0) {
    return 0;
}

gdImageCopyResampled() returns void, so the early return can't be detected. PHP_FUNCTION(imagecopyresampled) in ext/gd/gd.c does no validation of its own and unconditionally returns true. By contrast, PHP_FUNCTION(imagecopyresized) already throws a ValueError ("must be greater than 0") for non-positive widths/heights.

This doesn't appear in UPGRADING, and I couldn't find an existing report.

The same helper is on libgd's master branch (unreleased), so builds against an external libgd 2.3.x do not appear to be affected. Only the bundled GD in 8.6 is. However, once libgd 2.4 is released, --with-external-gd builds will be affected too, so it's likely worth fixing upstream in libgd/libgd as well.

Suggested Fix

Ideally, negative source dimensions would keep working as before, given how much existing code relies on them.

If dropping support for negative dimensions is intentional, I'd suggest doing it through the usual deprecation path rather than as a silent behavior change in 8.6:

  1. Restore the previous behavior in 8.6, and emit an E_DEPRECATED diagnostic when a negative $src_width/$src_height is passed, so existing code keeps working while affected projects get a clear signal to migrate (for example, to imageflip()).
  2. In a future release, remove support and throw a ValueError matching imagecopyresized().

If the new behavior is kept as is, it should at least raise a ValueError instead of silently returning true, and be documented in UPGRADING.

PHP Version
PHP 8.6.0RC4 (cli) (built: Oct 28 2026 01:20:17) (ZTS)
Copyright © The PHP Group and Contributors
Built by https://github.com/docker-library/php
Zend Engine v4.6.0RC4, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0RC4, Copyright ©, by Zend by Perforce
Operating System

No response

Vorherrschende Sprache
C
Sterne
41.8k
Forks
8.5k
Ø Merge
2 T. 13 Std.
Gemergte PRs (30 T.)
145

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus php/php-src

Alle Issues in php/php-src

Ähnliche Issues

Weitere Issues zu C

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.