From 6f01b897d1a785b072b60d8a2ae700392708de8b Mon Sep 17 00:00:00 2001
From: lacatoire <la.catoire@gmail.com>
Date: Fri, 16 Oct 2026 11:04:38 +0200
Subject: [PATCH] ext/gd: return after the imagecreatefromstring() length error

---
 ext/gd/gd.c                                   |  1 +
 .../tests/imagecreatefromstring_too_long.phpt | 24 +++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 ext/gd/tests/imagecreatefromstring_too_long.phpt

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 4221999385a1..5ecb393feac6 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1425,6 +1425,7 @@ PHP_FUNCTION(imagecreatefromstring)
 
 	if (ZSTR_LEN(data) > INT_MAX) {
 		zend_argument_value_error(1, "is too long");
+		RETURN_THROWS();
 	}
 
 	imtype = _php_image_type(data);
diff --git a/ext/gd/tests/imagecreatefromstring_too_long.phpt b/ext/gd/tests/imagecreatefromstring_too_long.phpt
new file mode 100644
index 000000000000..97ab5c9e495d
--- /dev/null
+++ b/ext/gd/tests/imagecreatefromstring_too_long.phpt
@@ -0,0 +1,24 @@
+--TEST--
+imagecreatefromstring(): a string longer than INT_MAX throws without decoding it
+--EXTENSIONS--
+gd
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 8) die('skip 64-bit only');
+if (getenv("SKIP_SLOW_TESTS")) die('skip slow test');
+?>
+--INI--
+memory_limit=-1
+--FILE--
+<?php
+$s = str_repeat("x", 2147483648);
+try {
+    imagecreatefromstring($s);
+} catch (ValueError $e) {
+    echo $e->getMessage(), "\n";
+}
+echo "Done\n";
+?>
+--EXPECT--
+imagecreatefromstring(): Argument #1 ($data) is too long
+Done