`imagecopyresampled()` silently copies nothing when given negative source width/height (regression in 8.6 after GD 2.4 sync)

Đang mở
  • Có gì không ổn?
#25,175 1 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
48/100
Loại issue
Lỗi
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
c, php
Lĩnh vực
computer-graphics

Hướng nghiên cứu

Reproduce the reported flips with the supplied PHP script, then read PHP_FUNCTION(imagecopyresampled) in ext/gd/gd.c and gdImageClipCopyResized() in ext/gd/libgd/gd_intern.h. The issue leaves open whether negative dimensions should remain supported or be deprecated and rejected, so clarify that expected behavior before changing code. Done means the chosen behavior is covered by regression tests and no longer silently leaves the destination blank.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

Bug Status: Needs Triage
Description

The following code:

<?php
$w = 100;
$h = 100;

$src = imagecreatetruecolor($w, $h);
imagefilledrectangle($src, 0, 0, $w - 1, $h - 1, imagecolorallocate($src, 0, 0, 255)); // blue
imagefilledrectangle($src, 0, 0, 9, 9, imagecolorallocate($src, 255, 0, 0));            // red top-left corner

$cases = [
    'horizontal flip (negative src_width)' => [$w - 1, 0, -$w, $h],
    'vertical flip (negative src_height)'  => [0, $h - 1, $w, -$h],
    'both (negative src_width/src_height)' => [$w - 1, $h - 1, -$w, -$h],
];

foreach ($cases as $label => [$src_x, $src_y, $src_w, $src_h]) {
    $dst = imagecreatetruecolor($w, $h);
    $ret = imagecopyresampled($dst, $src, 0, 0, $src_x, $src_y, $w, $h, $src_w, $src_h);
    printf(
        "%s: return=%s top-left=%06x top-right=%06x bottom-left=%06x bottom-right=%06x\n",
        $label,
        var_export($ret, true),
        imagecolorat($dst, 0, 0),
        imagecolorat($dst, $w - 1, 0),
        imagecolorat($dst, 0, $h - 1),
        imagecolorat($dst, $w - 1, $h - 1)
    );
}

Resulted in this output:

horizontal flip (negative src_width): return=true top-left=000000 top-right=000000 bottom-left=000000 bottom-right=000000
vertical flip (negative src_height): return=true top-left=000000 top-right=000000 bottom-left=000000 bottom-right=000000
both (negative src_width/src_height): return=true top-left=000000 top-right=000000 bottom-left=000000 bottom-right=000000

But I expected this output instead:

horizontal flip (negative src_width): return=true top-left=0000ff top-right=ff0000 bottom-left=0000ff bottom-right=0000ff
vertical flip (negative src_height): return=true top-left=0000ff top-right=0000ff bottom-left=ff0000 bottom-right=0000ff
both (negative src_width/src_height): return=true top-left=0000ff top-right=0000ff bottom-left=0000ff bottom-right=ff0000
Additional context

The output above is from PHP 8.6.0RC4 (gd_info()['GD Version']: bundled (2.4.0 compatible)). The expected output is the actual output of the same script on PHP 8.5.12 (bundled (2.1.0 compatible)).

Since the bundled libgd was synced to 2.4 (GH-22532), imagecopyresampled() no longer copies anything when $src_width or $src_height is negative. It still returns true, so the destination image is left as the blank (black) canvas from imagecreatetruecolor(), and the caller gets no warning or error. Calls with positive dimensions are unaffected: copying the same image with 0, 0, 100, 100 as the source area produces identical output on 8.5 and 8.6.

Passing a negative source width/height with $src_x/$src_y set to the opposite edge "has worked as a way to mirror/flip an image in several PHP releases prior to 8.6 (verified on 7.4, 8.0, 8.4, and 8.5). It was widely used before imageflip() was added in PHP 5.5 and is still in use today.

For example, WordPress core's GD image editor uses it to implement flipping (WP_Image_Editor_GD::flip()). On PHP 8.6 every flipped image comes out solid black. WordPress has flipped images this way since late 2009 and was first shipped in WordPress 2.9, which defined a minimum PHP version of 4.3.

A related report was created for WordPress' own tracking purposes on Trac.

Possible Cause

This appears to be caused by the new gdImageClipCopyResized() helper in ext/gd/libgd/gd_intern.h, which gdImageCopyResampled() now calls before copying any pixels:

if (*dstW <= 0 || *dstH <= 0 || *srcW <= 0 || *srcH <= 0) {
    return 0;
}

gdImageCopyResampled() returns void, so the early return can't be detected. PHP_FUNCTION(imagecopyresampled) in ext/gd/gd.c does no validation of its own and unconditionally returns true. By contrast, PHP_FUNCTION(imagecopyresized) already throws a ValueError ("must be greater than 0") for non-positive widths/heights.

This doesn't appear in UPGRADING, and I couldn't find an existing report.

The same helper is on libgd's master branch (unreleased), so builds against an external libgd 2.3.x do not appear to be affected. Only the bundled GD in 8.6 is. However, once libgd 2.4 is released, --with-external-gd builds will be affected too, so it's likely worth fixing upstream in libgd/libgd as well.

Suggested Fix

Ideally, negative source dimensions would keep working as before, given how much existing code relies on them.

If dropping support for negative dimensions is intentional, I'd suggest doing it through the usual deprecation path rather than as a silent behavior change in 8.6:

  1. Restore the previous behavior in 8.6, and emit an E_DEPRECATED diagnostic when a negative $src_width/$src_height is passed, so existing code keeps working while affected projects get a clear signal to migrate (for example, to imageflip()).
  2. In a future release, remove support and throw a ValueError matching imagecopyresized().

If the new behavior is kept as is, it should at least raise a ValueError instead of silently returning true, and be documented in UPGRADING.

PHP Version
PHP 8.6.0RC4 (cli) (built: Oct 28 2026 01:20:17) (ZTS)
Copyright © The PHP Group and Contributors
Built by https://github.com/docker-library/php
Zend Engine v4.6.0RC4, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0RC4, Copyright ©, by Zend by Perforce
Operating System

No response

Ngôn ngữ chính
C
Star
41.8k
Fork
8.5k
Merge trung bình
2 ngày 13 giờ
Pull request đã merge (30 ngày)
145

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của php/php-src

Tất cả issue của php/php-src

Issue tương tự

Thêm issue về C

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.