php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #55005 imagepolygon, imagefilledpolygon num_points requirement
Submitted: 2011-06-06 23:26 UTC Modified: 2019-11-16 13:26 UTC
Votes:2
Avg. Score:3.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: lbayuk at users dot sourceforge dot net Assigned: cmb (profile)
Status: Closed Package: GD related
PHP Version: 5.3.6 OS: n/a
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: lbayuk at users dot sourceforge dot net
New email:
PHP Version: OS:

 

 [2011-06-06 23:26 UTC] lbayuk at users dot sourceforge dot net
Description:
------------
The gd extension function imagepolygon() requires at least 3 points.  While this restriction is documented for imagefilledpolygon(), it is not documented for imagepolygon(). Since both are implemented with the same function php_imagepolygon() and contain the same check, the documentation for imagepolygon() should be updated to match imagefilledpolygon() in requiring at least 3 points.

However, this is not just a documentation problem. The implementation does not actually check for num_points >= 3 as the documentation for imagefilledpolygon says. It checks that the points array size is at least 6 (3 points, 2 values each). So you can plot a 2-point or even 1-point filled or unfilled polygon, if you use an array with 3 or more points in it but specify num_points=2 or 1.  This is very strange, not working as documented, and surely not as intended.

But there's more. As far as I can tell, libgd (bundled or stand-alone) doesn't actually have a 3-point minimum restriction to gdImagePolygon() or gdImageFilledPolygon(), although it does seem to be documented. See the sample code below, which plots 2-point filled and unfilled polygons by using the above trick. It also works with num_points=1.  If true, the PHP check for 3 or more points is not needed at all. 

Test script:
---------------
<?php
# Plot illegal 2-point polygon and filled polygon using over-sized array.
$g = imagecreate(300, 300);
$bgnd = imagecolorallocate($g, 255, 255, 255);
$fgnd = imagecolorallocate($g, 0, 0, 0);
imagefilledpolygon($g, array(100,10, 100,100, 180,100), 2, $fgnd);
imagepolygon($g, array(200,10, 200,100, 280,100), 2, $fgnd);
imagepng($g);


Expected result:
----------------
An error, since num_points=2 is not valid per documentation of ImageFilledPolygon.

Actual result:
--------------
A PNG image with 2 lines (2-point polygons).

Patches

imagepolygon-numpoints (last revision 2015-07-13 18:19 UTC by cmb@php.net)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-06-22 22:03 UTC] lbayuk at users dot sourceforge dot net
-: ljb9832 at pobox dot com +: lbayuk at users dot sourceforge dot net
 [2015-06-22 22:03 UTC] lbayuk at users dot sourceforge dot net
Verified still there in PHP-5.6.10
 [2015-07-13 18:19 UTC] cmb@php.net
The following patch has been added/updated:

Patch Name: imagepolygon-numpoints
Revision:   1436811588
URL:        https://bugs.php.net/patch-display.php?bug=55005&patch=imagepolygon-numpoints&revision=1436811588
 [2015-07-13 18:21 UTC] cmb@php.net
-Status: Open +Status: Verified
 [2015-07-13 18:21 UTC] cmb@php.net
Gee!

It seems to me the cleanest solution would be to get rid of the
$num_points parameter altogether, and to only check for an even
number of array elements (and maybe for a minimum count). Of
course, that would be a major BC break, and so is out of scope
before PHP 8, at least.

Should we rely on gdImage(Filled)Polygon() to behave reasonably
for 1 and 2 points? The libgd implementation might change sometime
to require at least 3 points, and anyway, monogons and digons are
usually not recognized as polygons. So probably we shouldn't.

To avoid any BC breaks for PHP 5, I suggest to only document that
imagepolygon must have at least 3 vertices, but not to enforce
that in the code.

For PHP 7 it seems to make sense to actually check for $num_points
>= 3; see the attached patch.
 [2017-01-21 17:44 UTC] cmb@php.net
-Assigned To: +Assigned To: cmb
 [2017-01-21 17:44 UTC] cmb@php.net
FTR: I've just emailed the internals list:
<http://news.php.net/php.internals/97915>.
 [2017-10-24 05:26 UTC] kalle@php.net
-Status: Verified +Status: Assigned
 [2019-11-02 13:05 UTC] cmb@php.net
Automatic comment from SVN on behalf of cmb
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=348252
Log: Fix #55005: imagepolygon num_points requirement
 [2019-11-02 13:06 UTC] cmb@php.net
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=7d96dcac2c6ce177a88ac9f15849cb499bf446bb
Log: Fix #55005: imagepolygon num_points requirement
 [2019-11-02 13:06 UTC] cmb@php.net
-Status: Assigned +Status: Closed
 [2019-11-02 13:10 UTC] salathe@php.net
Automatic comment on behalf of cmb
Revision: http://git.php.net/?p=doc/en.git;a=commit;h=fc27b3d46ce1d965e76351e431b53c42ebcb33f5
Log: Fix #55005: imagepolygon num_points requirement
 [2019-11-16 13:26 UTC] cmb@php.net
Supplement: yesterday a respective pull request[1] has been merged
into master (which will become PHP 8.0), which appears to the best
"fix" for now, namely to make the $num_points parameter optional.
For later versions this parameter is likely to be deprecated, and
eventually will hopefully be removed.

[1] <https://github.com/php/php-src/pull/4885>
 [2020-02-07 06:04 UTC] phpdocbot@php.net
Automatic comment on behalf of cmb
Revision: http://git.php.net/?p=doc/en.git;a=commit;h=b94027e267d75639ddab8a31107abc1fc44b72b3
Log: Fix #55005: imagepolygon num_points requirement
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Oct 27 16:01:27 2024 UTC