# imagescale out-of-bounds read

Out-of-bounds read in PHP's bundled libgd bicubic image scaling when left_channel index exceeds the 9-element Weights array, leaking adjacent memory.

- Payout: $500
- Severity: medium
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-31
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/141202
- Library page: https://bugbountylibrary.com/r/h1%3A141202
- Tags: domain:oss kind:bounty platform:hackerone sev:medium tech:php technique:fuzzing technique:source-review vuln:memory-corruption

**Target:** PHP ext/gd libgd bicubic interpolation (_gdScaleRow / _gdContributionsAlloc)
**Root cause:** The contribution weights array is allocated with windows_size=9 entries, but _gdScaleRow indexes Weights[left_channel] with left_channel=9 (10th element), reading past the allocation.
**Steps:**
1. Build PHP 7.0 with bundled libgd and debug symbols.
2. Craft an image and call imagescale with bicubic interpolation producing dst_width=13 (line_length=13, windows_size=9).
3. Break at gd_interpolation.c:982 in _gdScaleRow and observe left_channel=9.
4. Observe Weights[left_channel] reads the 10th element of a 9-element array (OOB read).
**How found:** Fuzzing PHP image functions (phuzz4.php) under gdb; breakpoints on _gdContributionsAlloc and _gdScaleRow revealed left_channel exceeding the allocated weights window.
**Insight:** Bicubic scaling weight arrays are sized by windows_size; fuzz dst_width values that make line_length/window boundaries mismatch and watch channel index vs array size in _gdScaleRow.