# PHP Integer Overflow in gdImageWebpCtx

Integer overflow in PHP's gdImageWebpCtx allocation lets a crafted 0x8000x0x8001 truecolor image cause a heap out-of-bounds write during imagewebp().

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by: binvul
- Disclosed: 2020-10-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/170619
- Library page: https://bugbountylibrary.com/r/h1%3A170619
- Tags: area:oss domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:dos vuln:memory-corruption

**Target:** PHP ext/gd libgd gd_webp.c imagewebp()
**Root cause:** gdMalloc(gdImageSX(im) * 4 * gdImageSY(im)) multiplies dimensions without overflow checks; 0x8000*0x8001*4 wraps to 0x20000, allocating a tiny buffer that the subsequent per-pixel write loop overflows.
**Steps:**
1. Build PHP 7.0.10 with `-fsanitize=address`
2. Run PoC: `$im = imagecreatetruecolor(0x8000, 0x8001); imagewebp($im, 'php.webp');`
3. Observe ASan heap-buffer-overflow WRITE of size 1 in gdImageWebpCtx at gd_webp.c:139
**How found:** Source review of gd_webp.c allocation arithmetic; recognized unchecked dimension multiplication could wrap 32-bit size, then crafted dimensions whose product*4 overflows to a small value.
**Insight:** When auditing image/codec libraries, target size computations of form width*height*bytes-per-pixel: pick dimensions near powers of two (0x8000, 0x8001) so the product wraps to a small allocation while loops still iterate full dimensions.