Skip to content

memory leak imagefttext #19955

Closed
Closed
memory leak imagefttext#19955
Assignees
devnexen
Labels
BugExtension: gdStatus: Verified

Description

@YuanchengJiang
YuanchengJiang
opened on Sep 25, 2025

Description

The following code:

<?php
$im = imagecreate(64, 32);
imagefttext($im, 16, 0, 10, 23, $fg, __DIR__ . "/Tuffy.ttf", 'Ж');

Resulted in this output:


=================================================================
==2337091==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 112 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6810bd)
    #1 0x70f14238b76c in __gconv_open iconv/./iconv/gconv_open.c:77:28
    #2 0x70f14238b2b7 in iconv_open iconv/./iconv/iconv_open.c:39:13
    #3 0x60200001aa0f  (<unknown module>)

Indirect leak of 32640 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6810bd)
    #1 0x70f14238b7e6 in __gconv_open iconv/./iconv/gconv_open.c:127:36
    #2 0x70f14238b2b7 in iconv_open iconv/./iconv/iconv_open.c:39:13
    #3 0x60200001aa0f  (<unknown module>)

Indirect leak of 208 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6810bd)
    #1 0x70f1423969d6 in __gconv_lookup_cache iconv/./iconv/gconv_cache.c:365:36

SUMMARY: AddressSanitizer: 32960 byte(s) leaked in 3 allocation(s).

To reproduce:

./php-src/sapi/cli/php  ./test.php

Commit:

e23c6222da50a2c5828a03ad701cd3351b13590d

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

nightly

Operating System

No response

Activity

  1. YuanchengJiang
    added
    Bug
    Status: Needs Triage
    on Sep 25, 2025

  2. devnexen commented on Sep 25, 2025

    @devnexen
    devnexen
    on Sep 25, 2025
    Member

    Hi @YuanchengJiang I can t reproduce this one. If you add this env var, what would be the output ?

  3. devnexen
    added
    Extension: gd
    on Sep 25, 2025

  4. YuanchengJiang commented on Sep 25, 2025

    @YuanchengJiang
    YuanchengJiang
    on Sep 25, 2025
    Author

    nice flag. would be:

    =================================================================
==3513404==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 112 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6810bd)
    #1 0x70d83b7ea76c in __gconv_open iconv/./iconv/gconv_open.c:77:28
    #2 0x70d83b7ea2b7 in iconv_open iconv/./iconv/iconv_open.c:39:13
    #3 0x15d3717 in do_convert /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdkanji.c:347:13
    #4 0x15d103c in do_check_and_conv /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdkanji.c:491:7
    #5 0x15d08b5 in php_gd_any2eucjp /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdkanji.c:568:9
    #6 0x15c0f7e in php_gd_gdImageStringFTEx /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdft.c:976:3
    #7 0x15bbfb6 in php_gd_gdImageStringFT /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdft.c:829:9
    #8 0x145b97f in php_imagettftext_common /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/gd.c:3378:11
    #9 0x145c17e in zif_imagefttext /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/gd.c:3314:2
    #10 0x60230be in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:1355:2
    #11 0x5b3f75b in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:115722:12
    #12 0x5b41cec in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:121434:2
    #13 0x68c4e09 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1977:3
    #14 0x50a195a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2640:13
    #15 0x50a2a98 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2680:9
    #16 0x68d9d1a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:951:5
    #17 0x68d40ff in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1362:18
    #18 0x70d83b7e9d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #19 0x70d83b7e9e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #20 0x6061f4 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6061f4)

Indirect leak of 32640 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6810bd)
    #1 0x70d83b7ea7e6 in __gconv_open iconv/./iconv/gconv_open.c:127:36
    #2 0x70d83b7ea2b7 in iconv_open iconv/./iconv/iconv_open.c:39:13
    #3 0x15d3717 in do_convert /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdkanji.c:347:13
    #4 0x15d103c in do_check_and_conv /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdkanji.c:491:7
    #5 0x15d08b5 in php_gd_any2eucjp /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdkanji.c:568:9
    #6 0x15c0f7e in php_gd_gdImageStringFTEx /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdft.c:976:3
    #7 0x15bbfb6 in php_gd_gdImageStringFT /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdft.c:829:9
    #8 0x145b97f in php_imagettftext_common /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/gd.c:3378:11
    #9 0x145c17e in zif_imagefttext /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/gd.c:3314:2
    #10 0x60230be in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:1355:2
    #11 0x5b3f75b in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:115722:12
    #12 0x5b41cec in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:121434:2
    #13 0x68c4e09 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1977:3
    #14 0x50a195a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2640:13
    #15 0x50a2a98 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2680:9
    #16 0x68d9d1a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:951:5
    #17 0x68d40ff in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1362:18
    #18 0x70d83b7e9d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #19 0x70d83b7e9e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #20 0x6061f4 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6061f4)

Indirect leak of 208 byte(s) in 1 object(s) allocated from:
    #0 0x6810bd in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6810bd)
    #1 0x70d83b7f59d6 in __gconv_lookup_cache iconv/./iconv/gconv_cache.c:365:36
    #2 0x70d83b7ebb6e in __gconv_find_transform iconv/./iconv/gconv_db.c:732:12
    #3 0x70d83b7ea705 in __gconv_open iconv/./iconv/gconv_open.c:73:9
    #4 0x70d83b7ea2b7 in iconv_open iconv/./iconv/iconv_open.c:39:13
    #5 0x15d3717 in do_convert /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdkanji.c:347:13
    #6 0x15d103c in do_check_and_conv /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdkanji.c:491:7
    #7 0x15d08b5 in php_gd_any2eucjp /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdkanji.c:568:9
    #8 0x15c0f7e in php_gd_gdImageStringFTEx /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdft.c:976:3
    #9 0x15bbfb6 in php_gd_gdImageStringFT /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/libgd/gdft.c:829:9
    #10 0x145b97f in php_imagettftext_common /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/gd.c:3378:11
    #11 0x145c17e in zif_imagefttext /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/gd/gd.c:3314:2
    #12 0x60230be in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:1355:2
    #13 0x5b3f75b in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:115722:12
    #14 0x5b41cec in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:121434:2
    #15 0x68c4e09 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1977:3
    #16 0x50a195a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2640:13
    #17 0x50a2a98 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2680:9
    #18 0x68d9d1a in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:951:5
    #19 0x68d40ff in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1362:18
    #20 0x70d83b7e9d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #21 0x70d83b7e9e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #22 0x6061f4 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6061f4)

SUMMARY: AddressSanitizer: 32960 byte(s) leaked in 3 allocation(s).

    You might need Tuffy.ttf

  5. devnexen
    added
    Status: Verified
    and removed
    Status: Needs Triage
    on Sep 25, 2025
  6. devnexen
    self-assigned this
    on Sep 25, 2025

  7. devnexen commented on Sep 25, 2025

    @devnexen
    devnexen
    on Sep 25, 2025
    Member

    alright seems a missing iconv_close in libgd. Loving this lib :)

  8. devnexen
    linked a pull request that will close this issueFix GH-19955: imagefttext() memory leak #19968on Sep 25, 2025
  9. devnexen
    added 2 commits that reference this issue on Sep 25, 2025

    Fix phpGH-19955: imagefttext() memory leak

    1bc83fb

    Fix GH-19955: imagefttext() memory leak

    e029f8f
  10. devnexen
    closed this as completedin e029f8fon Sep 29, 2025

  11. mnbv9764 commented on Oct 28, 2025

    @mnbv9764
    mnbv9764
    on Oct 28, 2025 · Hidden as spam
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

BugExtension: gdStatus: Verified

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions