- #39082, image* segfaults when used with only one argument

  (introduced in 5.2+, no news entry)

diff --git a/ext/gd/gd_ctx.c b/ext/gd/gd_ctx.c
index 480b8e3e57fd547d5ebfb708d145b51aed9231b3..0069f6c0dcd119225202a4bac063cade85626b0f 100644 (file)
--- a/ext/gd/gd_ctx.c
+++ b/ext/gd/gd_ctx.c
@@ -75,7 +75,9 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
        ZEND_FETCH_RESOURCE(im, gdImagePtr, imgind, -1, "Image", phpi_get_le_gd());
 
        if (argc > 1) {
-               convert_to_string_ex(file);
+               if (argc >= 2 && Z_TYPE_PP(file) != IS_NULL) {
+                       convert_to_string_ex(file);
+               }
                fn = Z_STRVAL_PP(file);
                if (argc >= 3) {
                        convert_to_long_ex(quality);
@@ -87,7 +89,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
                }
        }
 
-       if ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))) {
+       if (argc > 1 && (Z_TYPE_PP(file) != IS_NULL && ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))))) {
 
                PHP_GD_CHECK_OPEN_BASEDIR(fn, "Invalid filename");
 

diff --git a/ext/gd/tests/bug39082.phpt b/ext/gd/tests/bug39082.phpt
new file mode 100644 (file)
index 0000000..9bbfdb2
--- /dev/null
+++ b/ext/gd/tests/bug39082.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #39082 (Output image to stdout segfaults).
+--SKIPIF--
+<?php 
+       if (!extension_loaded('gd')) {  
+               die("skip gd extension not available\n");
+       }
+       if (!GD_BUNDLED) {
+               die('skip external GD libraries may fail');
+       }
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(1,1);
+imagegif($im);
+?>
+--EXPECTF--
+GIF87a%s