Commit 794fea483fb for php

commit 794fea483fbecd5604c904c8e39c7eae845c505c
Author: lacatoire <la.catoire@gmail.com>
Date:   Fri Oct 16 11:04:38 2026 +0200

    ext/gd: Fix imagecreatefromstring() continuing after the length error

    imagecreatefromstring() threw the ValueError for a string longer than
    INT_MAX but did not return, so it went on decoding the data with the
    exception pending. Return after throwing.

    Close GH-25411

diff --git a/NEWS b/NEWS
index bdafdf2ee9c..1ccaf0b661e 100644
--- a/NEWS
+++ b/NEWS
@@ -42,6 +42,10 @@ PHP                                                                        NEWS
   . Fixed stack overflow in filter_var() and filter_var_array() with deeply
     nested arrays. (Eyüp Can Akman)

+- GD:
+  . Fixed imagecreatefromstring() continuing to decode after throwing for a
+    string longer than INT_MAX. (lacatoire)
+
 - MBString:
   . Fixed stack overflow in mb_check_encoding() and mb_convert_encoding() with
     deeply nested arrays. (Eyüp Can Akman)
diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 2ac76382443..6f412a339f8 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1451,6 +1451,7 @@ PHP_FUNCTION(imagecreatefromstring)

 	if (ZSTR_LEN(data) > INT_MAX) {
 		zend_argument_value_error(1, "is too long");
+		RETURN_THROWS();
 	}

 	imtype = _php_image_type(data);
diff --git a/ext/gd/tests/imagecreatefromstring_too_long.phpt b/ext/gd/tests/imagecreatefromstring_too_long.phpt
new file mode 100644
index 00000000000..97ab5c9e495
--- /dev/null
+++ b/ext/gd/tests/imagecreatefromstring_too_long.phpt
@@ -0,0 +1,24 @@
+--TEST--
+imagecreatefromstring(): a string longer than INT_MAX throws without decoding it
+--EXTENSIONS--
+gd
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 8) die('skip 64-bit only');
+if (getenv("SKIP_SLOW_TESTS")) die('skip slow test');
+?>
+--INI--
+memory_limit=-1
+--FILE--
+<?php
+$s = str_repeat("x", 2147483648);
+try {
+    imagecreatefromstring($s);
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+echo "Done\n";
+?>
+--EXPECT--
+imagecreatefromstring(): Argument #1 ($data) is too long
+Done