imagesettile() and imagesetbrush() keep a dangling pointer once the tile is freed

未关闭
  • 哪里不对？
#25,334 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

这个 Issue 还没有评估数据。

描述

Description

imagesettile() passes the libgd pointer of the tile to gdImageSetTile() without keeping a reference to the tile object. Once the tile GdImage is freed, the image keeps a dangling pointer, and the next fill with IMG_COLOR_TILED reads freed memory. imagesetbrush() has the same shape, with IMG_COLOR_BRUSHED.

The following code:

<?php
$canvas = imagecreatetruecolor(100, 100);
(function () use ($canvas) {
    $tile = imagecreatetruecolor(10, 10);
    imagesettile($canvas, $tile);
})();
// The tile is freed: its memory is reused
$strings = [];
for ($i = 0; $i < 10000; ++$i) {
    $strings[] = str_repeat("\xff", 7000 + $i % 64);
}
imagefilledrectangle($canvas, 0, 0, 99, 99, IMG_COLOR_TILED);
echo "survived\n";

Resulted in this output:

Segmentation fault

But I expected this output instead:

survived

It crashes every time on PHP 8.5.12 (macOS, system libgd 2.3.3) and on PHP 8.4.27 (the php:8.4-cli Docker image, bundled GD). The same script with imagesetbrush() and imageline(..., IMG_COLOR_BRUSHED) also crashes on 8.5.12.

In ext/gd/gd.c on master, PHP_FUNCTION(imagesettile) and PHP_FUNCTION(imagesetbrush) only call gdImageSetTile(im, tile) and gdImageSetBrush(im, tile), and php_gd_image_object has no field that would hold the tile or the brush. A fix could keep a reference to the tile and brush objects in php_gd_image_object, released when they are replaced and when the image is freed (and reported by get_gc).

I found it while drawing SVG patterns with GD in a userland library: keeping the tile in a variable until the drawing ends works around it.

PHP Version
PHP 8.5.12 (cli) (ZTS)
PHP 8.4.27 (cli) (php:8.4-cli Docker image)
Operating System

macOS 27; Debian (Docker)

主要语言
C
星标
41.8k
派生
8.5k
平均合并
2 天 12 小时
30 天内合并 PR
137

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

php/php-src 的其他 Issue

查看 php/php-src 的全部 Issue

相似的 Issue

更多 C Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。