From aad2b534deba3f43ec99dc3c09d049fe3bc96c72 Mon Sep 17 00:00:00 2001 From: Weilin Du Date: Wed, 19 Aug 2026 13:40:28 +0800 Subject: [PATCH 1/2] ext/gd: Fix incorrect argument numbers in GD affine function errors (#23356) This fixes wrong argument in error message in imageaffinematrixget and mageaffinematrixconcat. --- NEWS | 4 ++++ ext/gd/gd.c | 4 ++-- ext/gd/tests/bug67248.phpt | 4 ++-- ext/gd/tests/imageaffinematrixconcat_error.phpt | 14 ++++++++++++++ 4 files changed, 22 insertions(+), 4 deletions(-) create mode 100644 ext/gd/tests/imageaffinematrixconcat_error.phpt diff --git a/NEWS b/NEWS index 7216f5c5a7d9..e273a86dfca6 100644 --- a/NEWS +++ b/NEWS @@ -14,6 +14,10 @@ PHP NEWS . Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the value of an attribute whose child still has a live wrapper. (iliaal) +- GD: + . Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the + wrong argument in error messages. (Weilin Du) + - Intl: . Fixed a double-free when IntlGregorianCalendar construction fails after the ICU constructor adopts the TimeZone. (iliaal) diff --git a/ext/gd/gd.c b/ext/gd/gd.c index 311900ba7bb3..c12586522594 100644 --- a/ext/gd/gd.c +++ b/ext/gd/gd.c @@ -4210,7 +4210,7 @@ PHP_FUNCTION(imageaffinematrixget) case GD_AFFINE_SCALE: { double x, y; if (Z_TYPE_P(options) != IS_ARRAY) { - zend_argument_type_error(1, "must be of type array when using translate or scale"); + zend_argument_type_error(2, "must be of type array when using translate or scale"); RETURN_THROWS(); } @@ -4291,7 +4291,7 @@ PHP_FUNCTION(imageaffinematrixconcat) } if (zend_hash_num_elements(Z_ARRVAL_P(z_m2)) != 6) { - zend_argument_value_error(1, "must have 6 elements"); + zend_argument_value_error(2, "must have 6 elements"); RETURN_THROWS(); } diff --git a/ext/gd/tests/bug67248.phpt b/ext/gd/tests/bug67248.phpt index a002f71c7fd3..5f00b94fadcd 100644 --- a/ext/gd/tests/bug67248.phpt +++ b/ext/gd/tests/bug67248.phpt @@ -17,8 +17,8 @@ for($i=0;$i<7;$i++) { } ?> --EXPECTF-- -!! [TypeError] imageaffinematrixget(): Argument #1 ($type) must be of type array when using translate or scale -!! [TypeError] imageaffinematrixget(): Argument #1 ($type) must be of type array when using translate or scale +!! [TypeError] imageaffinematrixget(): Argument #2 ($options) must be of type array when using translate or scale +!! [TypeError] imageaffinematrixget(): Argument #2 ($options) must be of type array when using translate or scale Warning: Object of class stdClass could not be converted to float in %s on line %d array(6) { diff --git a/ext/gd/tests/imageaffinematrixconcat_error.phpt b/ext/gd/tests/imageaffinematrixconcat_error.phpt new file mode 100644 index 000000000000..91b355547f38 --- /dev/null +++ b/ext/gd/tests/imageaffinematrixconcat_error.phpt @@ -0,0 +1,14 @@ +--TEST-- +imageaffinematrixconcat() reports the correct argument for an invalid matrix size +--EXTENSIONS-- +gd +--FILE-- +getMessage(), "\n"; +} +?> +--EXPECT-- +ValueError: imageaffinematrixconcat(): Argument #2 ($matrix2) must have 6 elements From 19bbfbdba594e990fa1892a82ce206d1dfade6a8 Mon Sep 17 00:00:00 2001 From: Weilin Du Date: Wed, 19 Aug 2026 13:49:21 +0800 Subject: [PATCH 2/2] [skip ci] fix NEWS section order --- NEWS | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/NEWS b/NEWS index 8c7f02bb94d2..3029480c18b0 100644 --- a/NEWS +++ b/NEWS @@ -32,17 +32,6 @@ PHP NEWS . Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the wrong argument in error messages. (Weilin Du) -- PDO: - . Fixed a leak when a persistent connection failed a liveness check - with no other live PDO handle. (iliaal) - -- PDO_PGSQL: - . Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite - loop when cleaning up a fetch left in a COPY, a use-after-free when a - statement with emulated or disabled prepares is destroyed, a connection - left busy for the next fetch, and rows delivered from a result another - statement took over. (KentarouTakeda) - - Intl: . Fixed grapheme_strrev() treating UBRK_DONE as a byte index and leaving the result without a terminating NUL. (iliaal) @@ -54,6 +43,17 @@ PHP NEWS (iliaal, Xuyang Zhang) . Fixed grapheme_str_split() treating UBRK_DONE as a byte index. (iliaal) +- PDO: + . Fixed a leak when a persistent connection failed a liveness check + with no other live PDO handle. (iliaal) + +- PDO_PGSQL: + . Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite + loop when cleaning up a fetch left in a COPY, a use-after-free when a + statement with emulated or disabled prepares is destroyed, a connection + left busy for the next fetch, and rows delivered from a result another + statement took over. (KentarouTakeda) + - Phar: . Fixed Phar archives being automatically detected when ".phar" only occurs in a directory name or is not a filename extension in an included file's @@ -62,6 +62,9 @@ PHP NEWS - Readline: . Fixed class constant completion in the interactive shell. (Weilin Du) +- SAPI: + . Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo) + - Session: . Fixed bug GH-23056 (missing handler name in session write warning). (lazerg) @@ -72,9 +75,6 @@ PHP NEWS . Fixed bug GH-17787 (ZipArchive stream stops reading early when the archive is freed while the stream is still open). (Eyüp Can Akman) -- SAPI: - . Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo) - 13 Aug 2026, PHP 8.6.0beta1 - Core: