From 5e8f881b132d68ac1b58630f3a19f0b7c3ebc0bf Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Fri, 3 Jul 2026 13:36:48 +0100
Subject: [PATCH 1/3] ext/standard: getimagesizefromstring() overflow.

close GH-22574
---
 ext/standard/image.c                               |  2 +-
 .../image/getimagesizefromstring_iff_overflow.phpt | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/image/getimagesizefromstring_iff_overflow.phpt

diff --git a/ext/standard/image.c b/ext/standard/image.c
index 15761364c341..0e6ee0897975 100644
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -874,7 +874,7 @@ static struct gfxinfo *php_handle_iff(php_stream * stream)
 		if (size < 0) {
 			return NULL;
 		}
-		if ((size & 1) == 1) {
+		if ((size & 1) == 1 && size < INT_MAX) {
 			size++;
 		}
 		if (chunkId == 0x424d4844) { /* BMHD chunk */
diff --git a/ext/standard/tests/image/getimagesizefromstring_iff_overflow.phpt b/ext/standard/tests/image/getimagesizefromstring_iff_overflow.phpt
new file mode 100644
index 000000000000..ed8f8d4b901b
--- /dev/null
+++ b/ext/standard/tests/image/getimagesizefromstring_iff_overflow.phpt
@@ -0,0 +1,14 @@
+--TEST--
+getimagesizefromstring() IFF chunk size integer overflow (GH-getimagesize_oflow)
+--CREDITS--
+Alexandre Daubois
+--FILE--
+<?php
+// IFF/ILBM with a chunk size of INT_MAX (0x7fffffff), an odd value.
+// The parser rounds odd chunk sizes up to even via size++, which overflowed
+// when size == INT_MAX. It must be handled gracefully rather than triggering UB.
+$payload = "FORM" . "\x00\x00\x00\x00" . "ILBM" . "ABCD" . "\x7f\xff\xff\xff";
+var_dump(getimagesizefromstring($payload));
+?>
+--EXPECT--
+bool(false)

From 94a011e47f21a8413f460fe7de4c5f508d0f5aa0 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Mon, 6 Jul 2026 09:30:12 +0100
Subject: [PATCH 2/3] apply suggestion

---
 ext/standard/image.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ext/standard/image.c b/ext/standard/image.c
index 0e6ee0897975..4709b93d0a5a 100644
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -874,7 +874,10 @@ static struct gfxinfo *php_handle_iff(php_stream * stream)
 		if (size < 0) {
 			return NULL;
 		}
-		if ((size & 1) == 1 && size < INT_MAX) {
+		if ((size & 1) == 1) {
+			if (size == INT_MAX) {
+				return NULL;
+			}
 			size++;
 		}
 		if (chunkId == 0x424d4844) { /* BMHD chunk */

From 805727575a107b710900706ebc4a8238b361880d Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Mon, 6 Jul 2026 09:52:20 +0100
Subject: [PATCH 3/3] adding getimagesize case

---
 NEWS                                                   |  2 ++
 .../image/getimagesizefromstring_iff_overflow.phpt     | 10 ++++++++++
 2 files changed, 12 insertions(+)

diff --git a/NEWS b/NEWS
index 0f39334377e0..8cead60815d1 100644
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,8 @@ PHP                                                                        NEWS
     incremental flush). (David Carlier)
   . Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
     (Weilin Du)
+  . Fixed integer overflow in getimagesize() and getimagesizefromstring() when
+    parsing an IFF chunk with a size of INT_MAX. (David Carlier, Weilin Du)
 
 02 Jul 2026, PHP 8.4.23
 
diff --git a/ext/standard/tests/image/getimagesizefromstring_iff_overflow.phpt b/ext/standard/tests/image/getimagesizefromstring_iff_overflow.phpt
index ed8f8d4b901b..f6fdea9d8e6b 100644
--- a/ext/standard/tests/image/getimagesizefromstring_iff_overflow.phpt
+++ b/ext/standard/tests/image/getimagesizefromstring_iff_overflow.phpt
@@ -9,6 +9,16 @@ Alexandre Daubois
 // when size == INT_MAX. It must be handled gracefully rather than triggering UB.
 $payload = "FORM" . "\x00\x00\x00\x00" . "ILBM" . "ABCD" . "\x7f\xff\xff\xff";
 var_dump(getimagesizefromstring($payload));
+
+// getimagesize() shares the same IFF parser through the file path.
+$file = __DIR__ . "/getimagesizefromstring_iff_overflow.iff";
+file_put_contents($file, $payload);
+var_dump(getimagesize($file));
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . "/getimagesizefromstring_iff_overflow.iff");
 ?>
 --EXPECT--
 bool(false)
+bool(false)