integer overflow in imagefilledpolygon #21180
Description
Description
The following code:
<?php
$v_12873 = 2;
$v_12797 = 256;
$v_12798 = 256;
$v_12799 = imagecreatetruecolor($v_12797,$v_12798,);
$v_12835 = 255;
$v_12836 = 0;
$v_12837 = 255;
$v_12838 = 10;
$v_12839 = imagecolorallocatealpha($v_12799,$v_12835,$v_12836,$v_12837,$v_12838,);
$v_12851 = 255;
$v_12843 = 10;
$v_12933 = 2;
$v_12852 = 30;
$v_12934 = $v_12933 * $v_12852;
$v_12810 = 255;
$v_12811 = 0;
$v_12812 = 0;
$v_12813 = 10;
$v_12814 = imagecolorallocatealpha($v_12799,$v_12810,$v_12811,$v_12812,$v_12813,);
$v_12800 = 255;
$v_12801 = 255;
$v_12802 = 255;
$v_12803 = 10;
$v_12804 = imagecolorallocatealpha($v_12799,$v_12800,$v_12801,$v_12802,$v_12803,);
$v_12853 = 180;
$v_12916 = $v_12853 - $v_12852;
$v_12906 = 225;
$v_12917 = $v_12906 + $v_12852;
$v_12918 = $v_12853 + $v_12852;
$v_12919 = $v_12906 << $v_12852;
$v_12907 = array(0 => $v_12916,1 => $v_12906,2 => $v_12853,3 => $v_12917,4 => $v_12918,5 => $v_12906,6 => $v_12853,7 => $v_12919,);
$v_12815 = 0;
$v_12825 = 255;
$v_12826 = 255;
$v_12827 = 0;
$v_12828 = 10;
$v_12829 = imagecolorallocatealpha($v_12799,$v_12825,$v_12826,$v_12827,$v_12828,);
$v_12855 = 2;
$v_12850 = 40;
$v_12851 = 70;
$v_12875 = $v_12850 + $v_12851;
$v_12876 = 2;
$v_12877 = $v_12875 / $v_12876;
$v_12888 = 2;
$v_12850 = 240;
$v_12851 = 270;
$v_12887 = $v_12850 + $v_12851;
$v_12869 = 20;
$v_12870 = 80;
$v_12884 = $v_12869 << $v_12870;
$v_12853 = 100;
$v_12852 = 30;
$v_12856 = $v_12855 * $v_12852;
$v_12857 = $v_12853 and $v_12856;
$v_12891 = 15;
$v_12850 = !($v_12891);
$v_12851 = 15;
$v_12900 = $v_12850 and $v_12851;
$v_12901 = 2;
$v_12902 = $v_12900 == $v_12901;
$v_12848 = 255;
$v_12850 = 240;
$v_12858 = 2;
$v_12859 = $v_12858 * $v_12852;
$v_12860 = $v_12853 + $v_12859;
$v_12861 = $v_12853 + $v_12852;
$v_12862 = $v_12850 + $v_12851;
$v_12863 = 2;
$v_12864 = $v_12862 / $v_12863;
$v_12865 = (int)($v_12864);
$v_12854 = array(0 => $v_12853,1 => $v_12850,2 => $v_12857,3 => $v_12850,4 => $v_12860,5 => $v_12851,6 => $v_12861,7 => $v_12865,8 => $v_12853,9 => $v_12851,);
$v_12866 = imagefilledpolygon($v_12799,$v_12854,$v_12829,);
$v_12906 = 255;
$v_12927 = $v_12906 - $v_12852;
$v_12898 = 2;
$v_12841 = 0;
$v_12870 = 80;
$v_12816 = 255;
$v_12817 = 0;
$v_12818 = 10;
$v_12819 = imagecolorallocatealpha($v_12799,$v_12815,$v_12816,$v_12817,$v_12818,);
$v_12820 = 0;
$v_12842 = 100;
$v_12906 = 150;
$v_12909 = $v_12906 << $v_12852;
$v_12869 = 20;
$v_12897 = $v_12869 + $v_12870;
$v_12822 = 255;
$v_12823 = 10;
$v_12936 = 2;
$v_12937 = $v_12936 * $v_12852;
$v_12899 = $v_12897 / $v_12898;
$v_12854 = array(0 => $v_12869,1 => $v_12850,2 => $v_12870,3 => $v_12850,4 => $v_12870,5 => $v_12851,6 => $v_12869,7 => $v_12851,8 => $v_12899,9 => $v_12902,);
$v_12821 = 0;
$v_12824 = imagecolorallocatealpha($v_12799,$v_12820,$v_12821,$v_12822,$v_12823,);
$v_12903 = imagefilledpolygon($v_12799,$v_12854,$v_12824,);
$v_12853 = 150;
$v_12910 = $v_12853 + $v_12852;
$v_12805 = 0;
$v_12806 = 0;
$v_12807 = 0;
$v_12808 = 10;
$v_12809 = imagecolorallocatealpha($v_12799,$v_12805,$v_12806,$v_12807,$v_12808,);
$v_12853 = 225;
$v_12924 = $v_12853 - $v_12852;
$v_12925 = $v_12906 + $v_12852;
$v_12926 = $v_12853 + $v_12852;
$v_12907 = array(0 => $v_12924,1 => $v_12906,2 => $v_12853,3 => $v_12925,4 => $v_12926,5 => $v_12906,6 => $v_12853,7 => $v_12927,);
$v_12830 = 0;
$v_12831 = 255;
$v_12832 = 255;
$v_12833 = 10;
$v_12834 = imagecolorallocatealpha($v_12799,$v_12830,$v_12831,$v_12832,$v_12833,);
$v_12928 = imagefilledpolygon($v_12799,$v_12907,$v_12834,);
$v_12869 = 120;
$v_12870 = 180;
$v_12872 = $v_12869 + $v_12870;
$v_12874 = $v_12872 / $v_12873;
$v_12908 = $v_12853 - $v_12852;
$v_12911 = $v_12906 - $v_12852;
$v_12907 = array(0 => $v_12908,1 => $v_12906,2 => $v_12853,3 => $v_12909,4 => $v_12910,5 => $v_12906,6 => $v_12853,7 => $v_12911,);
$v_12889 = $v_12887 / $v_12888;
$v_12854 = array(0 => $v_12869,1 => $v_12850,2 => $v_12870,3 => $v_12850,4 => $v_12870,5 => $v_12851,6 => $v_12869,7 => $v_12851,8 => $v_12874,9 => $v_12877,);
$v_12912 = imagefilledpolygon($v_12799,$v_12907,$v_12819,);Resulted in this output:
/home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2849:40: runtime error: signed integer overflow: 0 - -2147483648 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/ext/gd/libgd/gd.c:2849:40
But I expected this output instead:
PHP Version
nightly
Operating System
No response