- MFB: #39082, image* segfaults when used with only one argument

(introduced in 5.2+, no news entry)

ext/gd/gd_ctx.c

@@ -74,7 +74,9 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	ZEND_FETCH_RESOURCE(im, gdImagePtr, imgind, -1, "Image", phpi_get_le_gd());
 
 	if (argc > 1) {
-		convert_to_string_ex(file);
+        if (argc >= 2 && Z_TYPE_PP(file) != IS_NULL) {
+			convert_to_string_ex(file);
+		}
 		fn = Z_STRVAL_PP(file);
 		if (argc >= 3) {
 			convert_to_long_ex(quality);
@@ -86,8 +88,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 		}
 	}
 
-	if ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))) {
-
+    if (argc > 1 && (Z_TYPE_PP(file) != IS_NULL && ((argc == 2) || (argc > 2 && Z_STRLEN_PP(file))))) {
 		PHP_GD_CHECK_OPEN_BASEDIR(fn, "Invalid filename");
 
 		fp = VCWD_FOPEN(fn, "wb");

ext/gd/tests/bug39082.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #39082 (Output image to stdout segfaults).
+--SKIPIF--
+<?php 
+	if (!extension_loaded('gd')) {	
+		die("skip gd extension not available\n");
+	}
+	if (!GD_BUNDLED) {
+		die('skip external GD libraries may fail');
+	}
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(1,1);
+imagegif($im);
+?>
+--EXPECTF--
+GIF87a%s