mirror of
https://github.com/php/php-src.git
synced 2026-04-28 10:43:30 +02:00
Christoph M. Becker
37d0c7b0e4
These tests actually check that no file with a name containing a NUL is created by the GD image output functions. This is superfluous, since it is sufficient to check that the function failed, and that an appropriate warning has been raised. We also add missing nullbyte injection tests.
23 lines
691 B
PHP
23 lines
691 B
PHP
--TEST--
|
|
Testing null byte injection in imagejpeg
|
|
--SKIPIF--
|
|
<?php
|
|
if(!extension_loaded('gd')){ die('skip gd extension not available'); }
|
|
$support = gd_info();
|
|
if (!isset($support['JPEG Support']) || $support['JPEG Support'] === false) {
|
|
print 'skip jpeg support not available';
|
|
}
|
|
?>
|
|
--CLEAN--
|
|
$tempdir = sprintf("%s/%s", sys_get_temp_dir(), preg_replace("~\.php$~", null, __FILE__));
|
|
foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
|
|
rmdir($tempdir);
|
|
--FILE--
|
|
<?php
|
|
$image = imagecreate(1,1);// 1px image
|
|
var_dump(imagejpeg($image, "./foo\0bar"));
|
|
?>
|
|
--EXPECTF--
|
|
Warning: imagejpeg(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
|
|
bool(false)
|