- MFB: #39082, image* segfaults when used with only one argument

 (introduced in 5.2+, no news entry)

diff --git a/ext/gd/gd_ctx.c b/ext/gd/gd_ctx.c
index 4b5c0b48ded4ef42c00e6d9af0a1df11d7c43e49..39090c515d641df0571924eed465058e3e972160 100644 (file)
--- a/ext/gd/gd_ctx.c
+++ b/ext/gd/gd_ctx.c
@@ -74,7 +74,9 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
        ZEND_FETCH_RESOURCE(im, gdImagePtr, imgind, -1, "Image", phpi_get_le_gd());
 
        if (argc > 1) {
-               convert_to_string_ex(file);
+        if (argc >= 2 && Z_TYPE_PP(file) != IS_NULL) {
+                       convert_to_string_ex(file);
+               }
                fn = Z_STRVAL_PP(file);
                if (argc >= 3) {
                        convert_to_long_ex(quality);
@@ -86,8 +88,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
                }
        }
 
-       if ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))) {
-
+    if (argc > 1 && (Z_TYPE_PP(file) != IS_NULL && ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))))) {
                PHP_GD_CHECK_OPEN_BASEDIR(fn, "Invalid filename");
 
                fp = VCWD_FOPEN(fn, "wb");

diff --git a/ext/gd/tests/bug39082.phpt b/ext/gd/tests/bug39082.phpt
new file mode 100644 (file)
index 0000000..9bbfdb2
--- /dev/null
+++ b/ext/gd/tests/bug39082.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #39082 (Output image to stdout segfaults).
+--SKIPIF--
+<?php 
+       if (!extension_loaded('gd')) {  
+               die("skip gd extension not available\n");
+       }
+       if (!GD_BUNDLED) {
+               die('skip external GD libraries may fail');
+       }
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(1,1);
+imagegif($im);
+?>
+--EXPECTF--
+GIF87a%s