Commit 2c2852ae8ea for php.net
commit 2c2852ae8ea6fa4adea6e11830ae7f1aa63f1303
Merge: 175548e868b 9f654decdc1
Author: David Carlier <devnexen@gmail.com>
Date: Thu Dec 4 23:14:01 2025 +0000
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
Fix GH-20622: imagestring/imagestringup overflow/underflow.
diff --cc NEWS
index a9d339042f4,d6b832917df..783e476f025
--- a/NEWS
+++ b/NEWS
@@@ -1,9 -1,12 +1,12 @@@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 8.3.30
+?? ??? ????, PHP 8.4.17
+ - GD:
+ . Fixed bug GH-20622 (imagestring/imagestringup overflow). (David Carlier)
+
-18 Dec 2025, PHP 8.3.29
+18 Dec 2025, PHP 8.4.16
- Core:
. Sync all boost.context files with release 1.86.0. (mvorisek)
diff --cc ext/gd/gd.c
index 497407d5a12,5efc8e4d52c..16e871f6bc3
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@@ -3021,9 -2760,11 +3021,10 @@@ static void php_imagechar(INTERNAL_FUNC
{
zval *IM;
zend_long X, Y, COL;
- char *C;
- size_t C_len;
+ zend_string *C;
gdImagePtr im;
- int ch = 0, col, x, y, i, l = 0;
+ int ch = 0, col, i, l = 0;
+ unsigned int x, y;
unsigned char *str = NULL;
zend_object *font_obj = NULL;
zend_long font_int = 0;