fix off-by-one in _php_image_output()

and prevent such errors in php_do_open_temporary_file()

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index dc706d53b006b3641766b97585043426bcc81a03..620490fa954070ce4e96a856956ffe1fd63cf844 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1778,7 +1778,7 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char
                char  buf[4096];
                char *path;
 
-               tmp = php_open_temporary_file("", "", &path TSRMLS_CC);
+               tmp = php_open_temporary_file(NULL, NULL, &path TSRMLS_CC);
                if (tmp == NULL) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open temporary file");
                        RETURN_FALSE;

diff --git a/main/php_open_temporary_file.c b/main/php_open_temporary_file.c
index b64ddc8dfea3ece605e1b4dbe227626ba980860f..9e602f210430f24234de1cd08e0220031bbaf470 100644 (file)
--- a/main/php_open_temporary_file.c
+++ b/main/php_open_temporary_file.c
@@ -98,6 +98,7 @@ static int php_do_open_temporary_file(const char *path, const char *pfx, char **
 {
        char *trailing_slash;
        char *opened_path;
+       int path_len = 0;
        int fd = -1;
 #ifndef HAVE_MKSTEMP
        int open_flags = O_CREAT | O_TRUNC | O_RDWR
@@ -111,11 +112,13 @@ static int php_do_open_temporary_file(const char *path, const char *pfx, char **
                return -1;
        }
 
+       path_len = strlen(path);
+
        if (!(opened_path = emalloc(MAXPATHLEN))) {
                return -1;
        }
 
-       if (IS_SLASH(path[strlen(path)-1])) {
+       if (!path_len || IS_SLASH(path[path_len - 1])) {
                trailing_slash = "";
        } else {
                trailing_slash = "/";