MFH: - Fixed bug #30120 (imagettftext() and imagettfbbox() accept too many parameters)

diff --git a/NEWS b/NEWS
index 7fb0b0e7d7ade6c69cad1d0d905afd8f740d9151..d905c5bbf603fbe93b6af331cf22b92519fbd954 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,8 @@ PHP 4                                                                      NEWS
 - Fixed bug #31055 (apache2filter: per request leak proportional to the full
   path of the request URI). (kameshj at fastmail dot fm)
 - Fixed bug #30446 (apache2handler: virtual() includes files out of sequence)
+- Fixed bug #30120 (imagettftext() and imagettfbbox() accept too many
+  parameters). (Jani)
 - Fixed bug #28930 (PHP sources pick wrong header files generated by bison).
   (eggert at gnu dot org)
 - Fixed bug #28074 (FastCGI: stderr should be written in a FCGI stderr stream).

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 3ee5acd26d76bc7295113bea74ffbd9395121a84..9f7cff8f1e060bd8007d555a800cfaf73b005cae 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -3008,11 +3008,11 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
        argc = ZEND_NUM_ARGS();
 
        if (mode == TTFTEXT_BBOX) {
-               if (argc < 4 || argc > 5 || zend_get_parameters_ex(argc, &PTSIZE, &ANGLE, &FONTNAME, &C, &EXT) == FAILURE) {
+               if (argc < 4 || argc > ((extended) ? 5 : 4) || zend_get_parameters_ex(argc, &PTSIZE, &ANGLE, &FONTNAME, &C, &EXT) == FAILURE) {
                        ZEND_WRONG_PARAM_COUNT();
                }
        } else {
-               if (argc < 8 || argc > 9 || zend_get_parameters_ex(argc, &IM, &PTSIZE, &ANGLE, &X, &Y, &COL, &FONTNAME, &C, &EXT) == FAILURE) {
+               if (argc < 8 || argc > ((extended) ? 9 : 8) || zend_get_parameters_ex(argc, &IM, &PTSIZE, &ANGLE, &X, &Y, &COL, &FONTNAME, &C, &EXT) == FAILURE) {
                        ZEND_WRONG_PARAM_COUNT();
                }
                ZEND_FETCH_RESOURCE(im, gdImagePtr, IM, -1, "Image", le_gd);