From: Pierre Joye <pajoye@php.net>
Date: Sun, 8 Oct 2006 17:42:55 +0000 (+0000)
Subject: - MFB: #39082, image* segfaults when used with only one argument
X-Git-Tag: RELEASE_1_0_0RC1~1348
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7ecbbfc2067fe2d764a68125e0fec06bcad63b32;p=php

- MFB: #39082, image* segfaults when used with only one argument
 (introduced in 5.2+, no news entry)
---

diff --git a/ext/gd/gd_ctx.c b/ext/gd/gd_ctx.c
index 4b5c0b48de..39090c515d 100644
--- a/ext/gd/gd_ctx.c
+++ b/ext/gd/gd_ctx.c
@@ -74,7 +74,9 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	ZEND_FETCH_RESOURCE(im, gdImagePtr, imgind, -1, "Image", phpi_get_le_gd());
 
 	if (argc > 1) {
-		convert_to_string_ex(file);
+        if (argc >= 2 && Z_TYPE_PP(file) != IS_NULL) {
+			convert_to_string_ex(file);
+		}
 		fn = Z_STRVAL_PP(file);
 		if (argc >= 3) {
 			convert_to_long_ex(quality);
@@ -86,8 +88,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 		}
 	}
 
-	if ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))) {
-
+    if (argc > 1 && (Z_TYPE_PP(file) != IS_NULL && ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))))) {
 		PHP_GD_CHECK_OPEN_BASEDIR(fn, "Invalid filename");
 
 		fp = VCWD_FOPEN(fn, "wb");
diff --git a/ext/gd/tests/bug39082.phpt b/ext/gd/tests/bug39082.phpt
new file mode 100644
index 0000000000..9bbfdb2e38
--- /dev/null
+++ b/ext/gd/tests/bug39082.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #39082 (Output image to stdout segfaults).
+--SKIPIF--
+<?php 
+	if (!extension_loaded('gd')) {	
+		die("skip gd extension not available\n");
+	}
+	if (!GD_BUNDLED) {
+		die('skip external GD libraries may fail');
+	}
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(1,1);
+imagegif($im);
+?>
+--EXPECTF--
+GIF87a%s