From 1da79a6c6e39f08a91c2e3ae9281c1b0e5261510 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Sat, 24 Sep 2016 00:35:24 +0200
Subject: [PATCH] Fix #73157 (again): imagegd2() ignores 3rd param if 4 are
 given

Obviously, there was a bad merge.
---
 NEWS                       |  1 +
 ext/gd/gd.c                |  8 ++++----
 ext/gd/tests/bug73157.phpt | 22 ++++++++++++++++++++++
 3 files changed, 27 insertions(+), 4 deletions(-)
 create mode 100644 ext/gd/tests/bug73157.phpt

diff --git a/NEWS b/NEWS
index 1bbb1f4b2b..b9ef512bd2 100644
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,7 @@ PHP                                                                        NEWS
     cmb)
   . Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
     (Mark Plomer, cmb)
+  . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb)
 
 - Mbstring:
   . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb)
diff --git a/ext/gd/gd.c b/ext/gd/gd.c
index 192aed0af4..5f086864ca 100644
--- a/ext/gd/gd.c
+++ b/ext/gd/gd.c
@@ -2614,11 +2614,11 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char
 
 	if (argc > 1) {
 		fn = file;
-		if (argc == 3) {
+		if (argc >= 3) {
 			q = quality;
-		}
-		if (argc == 4) {
-			t = type;
+			if (argc == 4) {
+				t = type;
+			}
 		}
 	}
 
diff --git a/ext/gd/tests/bug73157.phpt b/ext/gd/tests/bug73157.phpt
new file mode 100644
index 0000000000..b03e91ec9d
--- /dev/null
+++ b/ext/gd/tests/bug73157.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73157 (imagegd2() ignores 3rd param if 4 are given)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(8, 8);
+imagecolorallocate($im, 0, 0, 0);
+
+ob_start();
+imagegd2($im, null, 256, IMG_GD2_RAW);
+$buffer = ob_get_clean();
+
+$header = unpack('@10/nchunk_size', $buffer);
+printf("chunk size: %d\n", $header['chunk_size']);
+?>
+===DONE===
+--EXPECT--
+chunk size: 256
+===DONE===
-- 
2.49.0