MFH: Fixed bug #26309 (Fixed argument parsing for imageftbbox()).

diff --git a/NEWS b/NEWS
index b716b525b628e2163f49274b47dfe0972b2c1cfe..ca43849f8f2d23af22d01d5401f9ad5325c047cb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP 4                                                                      NEWS
 ?? ??? 2003, Version 4.3.5
 - Fixed header handler in NSAPI SAPI module (header->replace was ignored,
   send_default_content_type now sends value from php.ini). (Uwe Schindler)
+- Fixed bug #26309 (Fixed argument parsing for imageftbbox()). (Ilia)
 - Fixed bug #26285 (escapeshellarg() uses wrong quotes on windows). (Ilia)
 - Fixed bug #26267 (gmp_random() leaks memory and does not produce random
   numbers). (Jani)

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 69d7d34b4458d3620c459484104b818940ae6cfe..10b9689c803b76e1990086fbe59f80477a995731 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -2970,13 +2970,11 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
        argc = ZEND_NUM_ARGS();
 
        if (mode == TTFTEXT_BBOX) {
-               if ((extended && argc != 5) || (!extended && argc != 4) ||
-                               zend_get_parameters_ex(argc, &PTSIZE, &ANGLE, &FONTNAME, &C, &EXT) == FAILURE) {
+               if (argc < 4 || argc > 5 || zend_get_parameters_ex(argc, &PTSIZE, &ANGLE, &FONTNAME, &C, &EXT) == FAILURE) {
                        ZEND_WRONG_PARAM_COUNT();
                }
        } else {
-               if ((extended && argc != 9) || (!extended && argc != 8) ||
-                               zend_get_parameters_ex(argc, &IM, &PTSIZE, &ANGLE, &X, &Y, &COL, &FONTNAME, &C, &EXT) == FAILURE) {
+               if (argc < 8 || argc > 9 || zend_get_parameters_ex(argc, &IM, &PTSIZE, &ANGLE, &X, &Y, &COL, &FONTNAME, &C, &EXT) == FAILURE) {
                        ZEND_WRONG_PARAM_COUNT();
                }
                ZEND_FETCH_RESOURCE(im, gdImagePtr, IM, -1, "Image", le_gd);