{"record":{"id":"b8a18f7bfcddaa23","repo":"phacility/phabricator","slug":"unable-to-get-image-information-with-getimagesize","errorCode":null,"errorMessage":"Unable to get image information with getimagesize(): %s","messagePattern":"Unable to get image information with getimagesize\\(\\): (.+?)","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/files/transform/PhabricatorFileImageTransform.php","lineNumber":320,"sourceCode":"\n    // In particular, this defuses a resource exhaustion attack where the\n    // attacker uploads a 40,000 x 40,000 pixel PNGs of solid white. These\n    // kinds of files compress extremely well, but require a huge amount\n    // of memory and CPU to process.\n\n    $tmp = new TempFile();\n    Filesystem::writeFile($tmp, $data);\n    $tmp_path = (string)$tmp;\n\n    $trap = new PhutilErrorTrap();\n    $info = @getimagesize($tmp_path);\n    $errors = $trap->getErrorsAsString();\n    $trap->destroy();\n\n    unset($tmp);\n\n    if ($info === false) {\n      throw new Exception(\n        pht(\n          'Unable to get image information with getimagesize(): %s',\n          $errors));\n    }\n\n    list($width, $height) = $info;\n    if (($width <= 0) || ($height <= 0)) {\n      throw new Exception(\n        pht(\n          'Unable to determine image width and height with getimagesize().'));\n    }\n\n    $max_pixels = (4096 * 4096);\n    $img_pixels = ($width * $height);\n\n    if ($img_pixels > $max_pixels) {\n      throw new Exception(\n        pht(","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/files/transform/PhabricatorFileImageTransform.php#L302-L338","documentation":"getImage() writes the file bytes to a TempFile and calls getimagesize() on it as a cheap pre-flight before decoding; getimagesize() returned false, meaning PHP could not recognize the data as any known image format. The trapped PHP warnings are appended. This fires before any GD work, so it is a data/format problem, not a memory or GD problem.","triggerScenarios":"Transforming a file whose bytes are not a recognizable image: corrupted/truncated upload, a renamed non-image (e.g. .png that is actually HTML or a PDF), or an unsupported-by-PHP format (SVG, HEIC, AVIF depending on PHP version) that was labeled with an image/* MIME type.","commonSituations":"Clients that trust filename extensions when setting MIME type; drag-drop of SVGs into avatars/file storage where transforms are requested; interrupted uploads leaving truncated files; formats newer than the installed PHP.","solutions":["Inspect the actual bytes (file ./data or xxd | head) and re-upload a valid, supported raster image (GIF/JPEG/PNG/WebP per your PHP build).","Pre-validate uploads with getimagesize() (or Phabricator's file type detection) before accepting them as images eligible for transforms.","Skip transforms for formats you do not support (e.g. serve SVGs as-is instead of rasterizing)."],"exampleFix":"// before\n$thumb = $file->applyTransform($xform); // throws on non-image data\n\n// after\n$info = @getimagesize($file->getURI());\nif ($info === false) {\n  return null; // not transformable; handle original only\n}\n$thumb = $file->applyTransform($xform);","handlingStrategy":"validation","validationCode":"$info = @getimagesize($tmp_path);\nif ($info === false) {\n  // not a recognizable image: reject upload or skip transform\n  return null;\n}","typeGuard":null,"tryCatchPattern":"try {\n  $transformed = $file->applyTransform($xform);\n} catch (Exception $ex) {\n  $transformed = $file; // unreadable image data\n}","preventionTips":["Run getimagesize() on uploads at the trust boundary instead of trusting MIME headers or extensions.","Restrict transformable types to formats your PHP build supports (check gd_info()).","Handle SVG and other vector formats by serving them as-is rather than transforming."],"tags":["phabricator","image-transform","corrupt-file","unsupported-format","php"],"backgroundTag":"invalid-image-data","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}