diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 13da099b33506..847e0835bad4f 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -3433,7 +3433,24 @@ PHP_FUNCTION(imageconvolution) } } } - res = gdImageConvolution(im_src, matrix, (float)div, (float)offset); + + if (UNEXPECTED(!zend_finite(div))) { + zend_argument_value_error(3, "must be finite"); + RETURN_THROWS(); + } + + float div_float = (float) div; + if (UNEXPECTED(div_float == 0.0f)) { + zend_argument_value_error(3, "must not be 0"); + RETURN_THROWS(); + } + + if (UNEXPECTED(!zend_finite(offset))) { + zend_argument_value_error(4, "must be finite"); + RETURN_THROWS(); + } + + res = gdImageConvolution(im_src, matrix, div_float, (float) offset); if (res) { RETURN_TRUE; diff --git a/ext/gd/tests/gh16255.phpt b/ext/gd/tests/gh16255.phpt new file mode 100644 index 0000000000000..147dc5adf377b --- /dev/null +++ b/ext/gd/tests/gh16255.phpt @@ -0,0 +1,34 @@ +--TEST-- +GH-16255 (Unexpected nan value in ext/gd/libgd/gd_filter.c) +--EXTENSIONS-- +gd +--CREDITS-- +cmb69 +--FILE-- +getMessage(), "\n"; +} + +try { + imageconvolution($im, $matrix, 2.225E-307, 1.0); +} catch (ValueError $e) { + echo $e->getMessage(), "\n"; +} + +try { + imageconvolution($im, $matrix, 1, NAN); +} catch (ValueError $e) { + echo $e->getMessage(), "\n"; +} + +?> +--EXPECT-- +imageconvolution(): Argument #3 ($divisor) must be finite +imageconvolution(): Argument #3 ($divisor) must not be 0 +imageconvolution(): Argument #4 ($offset) must be finite