imagepolygon() and imagefilledpolygon() does not allow negative number of points...

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 985457451ca6333d76da50c054803d5b6549d1bf..7dbd84da687f55a5ed4081d3bba50861cec6ae0e 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -3749,7 +3749,10 @@ static void php_imagepolygon(INTERNAL_FUNCTION_PARAMETERS, int filled)
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must have at least 3 points in your array");
                RETURN_FALSE;
        }
-
+       if (npoints <= 0) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "You must give a positive number of points");
+               RETURN_FALSE;
+       }
        if (nelem < npoints * 2) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Trying to use %d points in array with only %d points", npoints, nelem/2);
                RETURN_FALSE;

diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
index c375cea87659e1569919c6cdb59e7bfe74934071..a0f79116538f9c94c8e451cce28fcf6dd226d0d1 100644 (file)
--- a/ext/gd/libgd/gd.c
+++ b/ext/gd/libgd/gd.c
@@ -3195,7 +3195,7 @@ void gdImagePolygon (gdImagePtr im, gdPointPtr p, int n, int c)
        typedef void (*image_line)(gdImagePtr im, int x1, int y1, int x2, int y2, int color);
        image_line draw_line;
 
-       if (!n) {
+       if (n <= 0) {
                return;
        }
 
@@ -3248,7 +3248,7 @@ void gdImageFilledPolygon (gdImagePtr im, gdPointPtr p, int n, int c)
        int ints;
        int fill_color;
 
-       if (!n) {
+       if (n <= 0) {
                return;
        }
 

diff --git a/ext/gd/tests/imagefilledpolygon_negative.phpt b/ext/gd/tests/imagefilledpolygon_negative.phpt
new file mode 100644 (file)
index 0000000..ced8530
--- /dev/null
+++ b/ext/gd/tests/imagefilledpolygon_negative.phpt
@@ -0,0 +1,15 @@
+--TEST--
+imagefilledpolygon() with a negative num of points
+--SKIPIF--
+<?php 
+       if (!function_exists('imagefilledpolygon')) die('skip imagefilledpolygon() not available'); 
+?>
+--FILE--
+<?php
+$im = imagecreate(100, 100);
+$black = imagecolorallocate($im, 0, 0, 0);
+if (imagefilledpolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
+imagedestroy($im);
+?>
+--EXPECTF--
+Warning: imagefilledpolygon(): You must give a positive number of points in %s on line %d

diff --git a/ext/gd/tests/imagepolygon_negative.phpt b/ext/gd/tests/imagepolygon_negative.phpt
new file mode 100644 (file)
index 0000000..bb9010c
--- /dev/null
+++ b/ext/gd/tests/imagepolygon_negative.phpt
@@ -0,0 +1,15 @@
+--TEST--
+imagepolygon() with a negative num of points
+--SKIPIF--
+<?php 
+       if (!function_exists('imagepolygon')) die('skip imagepolygon() not available'); 
+?>
+--FILE--
+<?php
+$im = imagecreate(100, 100);
+$black = imagecolorallocate($im, 0, 0, 0);
+if (imagepolygon($im, array(0, 0, 0, 0, 0, 0), -1, $black)) echo "should be false";
+imagedestroy($im);
+?>
+--EXPECTF--
+Warning: imagepolygon(): You must give a positive number of points in %s on line %d