MFH: fix off-by-one in _php_image_output()

and prevent such errors in php_do_open_temporary_file()

diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 52f00151c884f93f1b0e7dccca1b03d4ba234c9c..0b6cf7b8a5308f0c2b9548fa98ef65c43174c2a4 100644 (file)
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -1699,7 +1699,7 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char
                char  buf[4096];
                char *path;
 
-               tmp = php_open_temporary_file("", "", &path TSRMLS_CC);
+               tmp = php_open_temporary_file(NULL, NULL, &path TSRMLS_CC);
                if (tmp == NULL) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open temporary file");
                        RETURN_FALSE;

diff --git a/main/php_open_temporary_file.c b/main/php_open_temporary_file.c
index d1210d8230a3898cff4f77dfc1190c6677c8f1b9..523dc8a71be74733426545a20ede817151a0f900 100644 (file)
--- a/main/php_open_temporary_file.c
+++ b/main/php_open_temporary_file.c
@@ -106,6 +106,7 @@ static int php_do_open_temporary_file(const char *path, const char *pfx, char **
 {
        char *trailing_slash;
        char *opened_path;
+       int path_len = 0;
        int fd = -1;
 #ifndef HAVE_MKSTEMP
        int open_flags = O_CREAT | O_TRUNC | O_RDWR
@@ -122,11 +123,13 @@ static int php_do_open_temporary_file(const char *path, const char *pfx, char **
                return -1;
        }
 
+       path_len = strlen(path);
+
        if (!(opened_path = emalloc(MAXPATHLEN))) {
                return -1;
        }
 
-       if (IS_SLASH(path[strlen(path)-1])) {
+       if (!path_len || IS_SLASH(path[path_len - 1])) {
                trailing_slash = "";
        } else {
                trailing_slash = "/";