Commit 89f7cbd91e1 for php.net
commit 89f7cbd91e1c0d4b93e06115a368627bf6d736fc
Merge: ba9dfa733fb 6b68d9433fe
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date: Fri May 22 18:47:20 2026 -0400
Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
Fix GH-22121: double-free in gdImageSetStyle() after overflow early return
diff --cc NEWS
index eca9c29d787,460156172ca..595b7c8096f
--- a/NEWS
+++ b/NEWS
@@@ -1,7 -1,16 +1,11 @@@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 8.4.23
+?? ??? ????, PHP 8.5.8
+ - GD:
+ . Fixed bug GH-22121 (Double free in gdImageSetStyle() after
+ overflow-triggered early return). (iliaal)
+
-- Intl:
- . Fix incorrect argument positions for uninitialized calendar arguments in
- IntlCalendar::equals(), ::before(), ::after(), and ::isEquivalentTo().
- (Weilin Du)
-
- Zlib:
. Fixed memory leak if deflate initialization fails and there is a dict.
(ndossche)
diff --cc ext/gd/libgd/gd.c
index 71a0e9ea63f,0ab26647c1d..9563354a99d
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@@ -2877,11 -2847,13 +2877,8 @@@ void gdImageFilledPolygon (gdImagePtr i
}
}
-int gdCompareInt (const void *a, const void *b)
-{
- return (*(const int *) a) - (*(const int *) b);
-}
-
void gdImageSetStyle (gdImagePtr im, int *style, int noOfPixels)
{
- if (im->style) {
- gdFree(im->style);
- }
if (overflow2(sizeof (int), noOfPixels)) {
return;
}