Fix bug #22646

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 35cd383fde15dddd10aa9981c0503b99d7a7a57f..d013c6df470e7d6b411b5eec797704fa33629a57 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1639,7 +1639,7 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char
                }
        }
 
-       if ((argc == 2) || (argc == 3 && Z_STRLEN_PP(file))) {
+       if ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))) {
                if (!fn || fn == empty_string || php_check_open_basedir(fn TSRMLS_CC)) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid filename '%s'", fn);
                        RETURN_FALSE;

diff --git a/ext/gd/gd_ctx.c b/ext/gd/gd_ctx.c
index 8d94224816f052784644f5e96a96c1712c50370a..89853c1e60d0128ca2fbc483c5dffb96db2f4d6d 100644 (file)
--- a/ext/gd/gd_ctx.c
+++ b/ext/gd/gd_ctx.c
@@ -50,7 +50,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
                }
        }
 
-       if ((argc == 2) || (argc == 3 && Z_STRLEN_PP(file))) {
+       if ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))) {
                if (!fn || fn == empty_string || php_check_open_basedir(fn TSRMLS_CC)) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid filename '%s'", fn);
                        RETURN_FALSE;