From 89c3e0346a0c67e68c3e625cf463a9195cbfc7d3 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Thu, 4 Jul 2024 13:48:42 +0200
Subject: [PATCH] Fix GH-14808: Unexpected null pointer in Zend/zend_string.h
 with empty output buffer

The output buffer can be NULL when the number of bytes is zero.

Closes GH-14815.
---
 NEWS                      |  4 ++++
 main/output.c             |  6 +++++-
 tests/output/gh14808.phpt | 13 +++++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 tests/output/gh14808.phpt

diff --git a/NEWS b/NEWS
index 45afcaf352d..a4940d17434 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,10 @@ PHP                                                                        NEWS
 - LibXML:
   . Fixed bug GH-14563 (Build failure with libxml2 v2.13.0). (nielsdos)
 
+- Output:
+  . Fixed bug GH-14808 (Unexpected null pointer in Zend/zend_string.h with
+    empty output buffer). (nielsdos)
+
 - PDO:
   . Fixed bug GH-14712 (Crash with PDORow access to null property).
     (David Carlier)
diff --git a/main/output.c b/main/output.c
index 7b5bc49dab8..e894c4729d5 100644
--- a/main/output.c
+++ b/main/output.c
@@ -380,7 +380,11 @@ PHPAPI int php_output_get_level(void)
 PHPAPI int php_output_get_contents(zval *p)
 {
 	if (OG(active)) {
-		ZVAL_STRINGL(p, OG(active)->buffer.data, OG(active)->buffer.used);
+		if (OG(active)->buffer.used) {
+			ZVAL_STRINGL(p, OG(active)->buffer.data, OG(active)->buffer.used);
+		} else {
+			ZVAL_EMPTY_STRING(p);
+		}
 		return SUCCESS;
 	} else {
 		ZVAL_NULL(p);
diff --git a/tests/output/gh14808.phpt b/tests/output/gh14808.phpt
new file mode 100644
index 00000000000..7a3f57ba51c
--- /dev/null
+++ b/tests/output/gh14808.phpt
@@ -0,0 +1,13 @@
+--TEST--
+GH-14808 (Unexpected null pointer in Zend/zend_string.h with empty output buffer)
+--FILE--
+<?php
+var_dump($args);
+ob_start('ob_iconv_handler');
+ob_clean();
+var_dump(ob_get_contents());
+?>
+--EXPECTF--
+Warning: Undefined variable $args in %s on line %d
+NULL
+string(0) ""