`imagecopyresampled()` silently copies nothing when given negative source width/height (regression in 8.6 after GD 2.4 sync)

Abierto
  • ¿Algo no está bien?
#25,175 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
c, php
Área
computer-graphics

Línea de trabajo

Reproduce the reported flips with the supplied PHP script, then read PHP_FUNCTION(imagecopyresampled) in ext/gd/gd.c and gdImageClipCopyResized() in ext/gd/libgd/gd_intern.h. The issue leaves open whether negative dimensions should remain supported or be deprecated and rejected, so clarify that expected behavior before changing code. Done means the chosen behavior is covered by regression tests and no longer silently leaves the destination blank.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Bug Status: Needs Triage
Description

The following code:

<?php
$w = 100;
$h = 100;

$src = imagecreatetruecolor($w, $h);
imagefilledrectangle($src, 0, 0, $w - 1, $h - 1, imagecolorallocate($src, 0, 0, 255)); // blue
imagefilledrectangle($src, 0, 0, 9, 9, imagecolorallocate($src, 255, 0, 0));            // red top-left corner

$cases = [
    'horizontal flip (negative src_width)' => [$w - 1, 0, -$w, $h],
    'vertical flip (negative src_height)'  => [0, $h - 1, $w, -$h],
    'both (negative src_width/src_height)' => [$w - 1, $h - 1, -$w, -$h],
];

foreach ($cases as $label => [$src_x, $src_y, $src_w, $src_h]) {
    $dst = imagecreatetruecolor($w, $h);
    $ret = imagecopyresampled($dst, $src, 0, 0, $src_x, $src_y, $w, $h, $src_w, $src_h);
    printf(
        "%s: return=%s top-left=%06x top-right=%06x bottom-left=%06x bottom-right=%06x\n",
        $label,
        var_export($ret, true),
        imagecolorat($dst, 0, 0),
        imagecolorat($dst, $w - 1, 0),
        imagecolorat($dst, 0, $h - 1),
        imagecolorat($dst, $w - 1, $h - 1)
    );
}

Resulted in this output:

horizontal flip (negative src_width): return=true top-left=000000 top-right=000000 bottom-left=000000 bottom-right=000000
vertical flip (negative src_height): return=true top-left=000000 top-right=000000 bottom-left=000000 bottom-right=000000
both (negative src_width/src_height): return=true top-left=000000 top-right=000000 bottom-left=000000 bottom-right=000000

But I expected this output instead:

horizontal flip (negative src_width): return=true top-left=0000ff top-right=ff0000 bottom-left=0000ff bottom-right=0000ff
vertical flip (negative src_height): return=true top-left=0000ff top-right=0000ff bottom-left=ff0000 bottom-right=0000ff
both (negative src_width/src_height): return=true top-left=0000ff top-right=0000ff bottom-left=0000ff bottom-right=ff0000
Additional context

The output above is from PHP 8.6.0RC4 (gd_info()['GD Version']: bundled (2.4.0 compatible)). The expected output is the actual output of the same script on PHP 8.5.12 (bundled (2.1.0 compatible)).

Since the bundled libgd was synced to 2.4 (GH-22532), imagecopyresampled() no longer copies anything when $src_width or $src_height is negative. It still returns true, so the destination image is left as the blank (black) canvas from imagecreatetruecolor(), and the caller gets no warning or error. Calls with positive dimensions are unaffected: copying the same image with 0, 0, 100, 100 as the source area produces identical output on 8.5 and 8.6.

Passing a negative source width/height with $src_x/$src_y set to the opposite edge "has worked as a way to mirror/flip an image in several PHP releases prior to 8.6 (verified on 7.4, 8.0, 8.4, and 8.5). It was widely used before imageflip() was added in PHP 5.5 and is still in use today.

For example, WordPress core's GD image editor uses it to implement flipping (WP_Image_Editor_GD::flip()). On PHP 8.6 every flipped image comes out solid black. WordPress has flipped images this way since late 2009 and was first shipped in WordPress 2.9, which defined a minimum PHP version of 4.3.

A related report was created for WordPress' own tracking purposes on Trac.

Possible Cause

This appears to be caused by the new gdImageClipCopyResized() helper in ext/gd/libgd/gd_intern.h, which gdImageCopyResampled() now calls before copying any pixels:

if (*dstW <= 0 || *dstH <= 0 || *srcW <= 0 || *srcH <= 0) {
    return 0;
}

gdImageCopyResampled() returns void, so the early return can't be detected. PHP_FUNCTION(imagecopyresampled) in ext/gd/gd.c does no validation of its own and unconditionally returns true. By contrast, PHP_FUNCTION(imagecopyresized) already throws a ValueError ("must be greater than 0") for non-positive widths/heights.

This doesn't appear in UPGRADING, and I couldn't find an existing report.

The same helper is on libgd's master branch (unreleased), so builds against an external libgd 2.3.x do not appear to be affected. Only the bundled GD in 8.6 is. However, once libgd 2.4 is released, --with-external-gd builds will be affected too, so it's likely worth fixing upstream in libgd/libgd as well.

Suggested Fix

Ideally, negative source dimensions would keep working as before, given how much existing code relies on them.

If dropping support for negative dimensions is intentional, I'd suggest doing it through the usual deprecation path rather than as a silent behavior change in 8.6:

  1. Restore the previous behavior in 8.6, and emit an E_DEPRECATED diagnostic when a negative $src_width/$src_height is passed, so existing code keeps working while affected projects get a clear signal to migrate (for example, to imageflip()).
  2. In a future release, remove support and throw a ValueError matching imagecopyresized().

If the new behavior is kept as is, it should at least raise a ValueError instead of silently returning true, and be documented in UPGRADING.

PHP Version
PHP 8.6.0RC4 (cli) (built: Oct 28 2026 01:20:17) (ZTS)
Copyright © The PHP Group and Contributors
Built by https://github.com/docker-library/php
Zend Engine v4.6.0RC4, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0RC4, Copyright ©, by Zend by Perforce
Operating System

No response

Lenguaje dominante
C
Estrellas
41.8k
Forks
8.5k
Merge medio
2 d 13 h
PR fusionados (30 d)
145

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de php/php-src

Todos los issues de php/php-src

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.