#74337 pointer returned by php_stream_fopen_tmpfile not validated in memory.c

diff --git a/main/streams/memory.c b/main/streams/memory.c
index 6e3d1dd0c1e22b0ea21a00a416fcfc97fd213083..f4fd6a8f02912775879b5bab6653860b32be3d33 100644 (file)
--- a/main/streams/memory.c
+++ b/main/streams/memory.c
@@ -501,9 +501,14 @@ static int php_stream_temp_cast(php_stream *stream, int castas, void **ret)
                return FAILURE;
        }
 
+       file = php_stream_fopen_tmpfile();
+       if (file == NULL) {
+               php_error_docref(NULL, E_WARNING, "Unable to create temporary file.");
+               return FAILURE;
+       }
+
        /* perform the conversion and then pass the request on to the innerstream */
        membuf = php_stream_memory_get_buffer(ts->innerstream, &memsize);
-       file = php_stream_fopen_tmpfile();
        php_stream_write(file, membuf, memsize);
        pos = php_stream_tell(ts->innerstream);