|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #55005 imagepolygon, imagefilledpolygon num_points requirement
Submitted: 2011-06-06 23:26 UTC Modified: 2019-11-16 13:26 UTC
Avg. Score:3.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: lbayuk at users dot sourceforge dot net Assigned: cmb (profile)
Status: Closed Package: GD related
PHP Version: 5.3.6 OS: n/a
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: lbayuk at users dot sourceforge dot net
New email:
PHP Version: OS:


 [2011-06-06 23:26 UTC] lbayuk at users dot sourceforge dot net
The gd extension function imagepolygon() requires at least 3 points.  While this restriction is documented for imagefilledpolygon(), it is not documented for imagepolygon(). Since both are implemented with the same function php_imagepolygon() and contain the same check, the documentation for imagepolygon() should be updated to match imagefilledpolygon() in requiring at least 3 points.

However, this is not just a documentation problem. The implementation does not actually check for num_points >= 3 as the documentation for imagefilledpolygon says. It checks that the points array size is at least 6 (3 points, 2 values each). So you can plot a 2-point or even 1-point filled or unfilled polygon, if you use an array with 3 or more points in it but specify num_points=2 or 1.  This is very strange, not working as documented, and surely not as intended.

But there's more. As far as I can tell, libgd (bundled or stand-alone) doesn't actually have a 3-point minimum restriction to gdImagePolygon() or gdImageFilledPolygon(), although it does seem to be documented. See the sample code below, which plots 2-point filled and unfilled polygons by using the above trick. It also works with num_points=1.  If true, the PHP check for 3 or more points is not needed at all. 

Test script:
# Plot illegal 2-point polygon and filled polygon using over-sized array.
$g = imagecreate(300, 300);
$bgnd = imagecolorallocate($g, 255, 255, 255);
$fgnd = imagecolorallocate($g, 0, 0, 0);
imagefilledpolygon($g, array(100,10, 100,100, 180,100), 2, $fgnd);
imagepolygon($g, array(200,10, 200,100, 280,100), 2, $fgnd);

Expected result:
An error, since num_points=2 is not valid per documentation of ImageFilledPolygon.

Actual result:
A PNG image with 2 lines (2-point polygons).


imagepolygon-numpoints (last revision 2015-07-13 18:19 UTC by

Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2015-06-22 22:03 UTC] lbayuk at users dot sourceforge dot net
-: ljb9832 at pobox dot com +: lbayuk at users dot sourceforge dot net
 [2015-06-22 22:03 UTC] lbayuk at users dot sourceforge dot net
Verified still there in PHP-5.6.10
 [2015-07-13 18:19 UTC]
The following patch has been added/updated:

Patch Name: imagepolygon-numpoints
Revision:   1436811588
 [2015-07-13 18:21 UTC]
-Status: Open +Status: Verified
 [2015-07-13 18:21 UTC]

It seems to me the cleanest solution would be to get rid of the
$num_points parameter altogether, and to only check for an even
number of array elements (and maybe for a minimum count). Of
course, that would be a major BC break, and so is out of scope
before PHP 8, at least.

Should we rely on gdImage(Filled)Polygon() to behave reasonably
for 1 and 2 points? The libgd implementation might change sometime
to require at least 3 points, and anyway, monogons and digons are
usually not recognized as polygons. So probably we shouldn't.

To avoid any BC breaks for PHP 5, I suggest to only document that
imagepolygon must have at least 3 vertices, but not to enforce
that in the code.

For PHP 7 it seems to make sense to actually check for $num_points
>= 3; see the attached patch.
 [2017-01-21 17:44 UTC]
-Assigned To: +Assigned To: cmb
 [2017-01-21 17:44 UTC]
FTR: I've just emailed the internals list:
 [2017-10-24 05:26 UTC]
-Status: Verified +Status: Assigned
 [2019-11-02 13:05 UTC]
Automatic comment from SVN on behalf of cmb
Log: Fix #55005: imagepolygon num_points requirement
 [2019-11-02 13:06 UTC]
Automatic comment on behalf of
Log: Fix #55005: imagepolygon num_points requirement
 [2019-11-02 13:06 UTC]
-Status: Assigned +Status: Closed
 [2019-11-02 13:10 UTC]
Automatic comment on behalf of cmb
Log: Fix #55005: imagepolygon num_points requirement
 [2019-11-16 13:26 UTC]
Supplement: yesterday a respective pull request[1] has been merged
into master (which will become PHP 8.0), which appears to the best
"fix" for now, namely to make the $num_points parameter optional.
For later versions this parameter is likely to be deprecated, and
eventually will hopefully be removed.

[1] <>
 [2020-02-07 06:04 UTC]
Automatic comment on behalf of cmb
Log: Fix #55005: imagepolygon num_points requirement
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Jul 21 05:01:30 2024 UTC