Your script is broken. (what is $output supposed to contain??)

fixed script, using PHP 4.3.2-RC, and it works fine.

Sorry, $output is the file name.
here is the correct code:

<?
header("Content-type: image/gif");
$output="bird.gif"; // file name
$fd = fopen($output,"r");
$filelength=filesize($output);
$contents = fread($fd,$filelength);
echo $contents; fclose($fd);
?>

I tried PHP version 4.3.2RC1. The same happens.
This bug appears with jpeg (.jpg) files too, with the "e99\r\n" code before the picture datas, and they can only be saved as BMP too.

Something more: this happens with all versions of Internet Explorer

I copied your script directly and found a bird.gif image out there.  You can see the result at:
http://lerdorf.com/bird.php
Source code at:
http://lerdorf.com/bird.phps
Works ok for me.  Perhaps you have something before or after the start/end php tags, or do you have weird line endings or something?  Do an "od -c bird.php" and compare it to:
http://lerdorf.com/bird.txt

the example bird.gif is actually JPEG, not GIF..
And when having the correct script with correct imagetype,
this all works just fine.

This is NOT any bug in PHP.

Disclaimer: the bird.gif _WAS_ jpeg before.. :)

Yes, the bird was in JPEG before, I changed it in GIF, to be more coherent with the code. It's because I tested several formats, sorry for this incovenience. However, the bug appears in GIF or JPEG, so the bug is the same now.

I just found out that the bug comes out only if we sent the "Cache-Control" header along with the picture, which is something I forgot to mention in my previous code, because I thought that it was not relevant. In fact, THIS IS the problem.

So here is the code that really generates the bug:

<?
header("Content-type: image/gif");
header("Cache-Control: no-cache, must-revalidate");
$output="bird.gif"; // file name
$fd = fopen($output,"r");
$filelength=filesize($output);
$contents = fread($fd,$filelength);
echo $contents; fclose($fd);
?>

If you comment out the Cache-Control header line, everything works fine, so this is a workaround. However, I think that it is still a PHP bug, don't you ?
Please try again (1 minute), I updated the report page:
http://www.edenpics.com/pub/iebug/iebug2.phtml

Thank you.

I don't see how this could possible be a PHP problem.  I see nothing wrong with the output of your script.  I sent an IE6 request and looked at the output.  The headers sent by http://www.edenpics.com/pub/iebug/bird.php were:

HTTP/1.1 200 OK
Date: Sat, 05 Apr 2003 23:13:47 GMT
Server: Apache
X-Powered-By: PHP/4.1.2
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Type: image/gif

Followed by this gif datastream:

0000000   G   I   F   8   9   a   2  \0   (  \0 367 204  \0 001 002 002
0000020 003 002  \t 005  \n 017  \b 003  \b  \f  \n 002  \n  \n  \v 003
0000040 006 025 006  \t 035  \n  \f 032  \f 021 036 024 024 026 020 024
0000060 036  \v 021   ! 016 023   ( 024 025   - 027 033   ) 022 031   2
0000100 033 036   0 032   $   . 025   #   8 033   !   < 030   (   :   !
0000120   +   E   #   ,   N   *   3   L   '   1   Q   '   1   \   1   <
0000140   V   /   <   b   ,   >   l   +   <   r   7   E   n   :   E   g
0000160   <   M   m   ;   J   s   =   L   ~   ?   P   |   A   N   x   B

I see nothing wrong.  

Here's much simpler script that can be used to reproduce this bug in IE6:

<?php

header("Content-type: image/gif");
header("Cache-Control: no-cache, must-revalidate"); 
readfile("bird.gif");

?>

And it really is bug in IE6..not in PHP. And it has actually existed in IE since IE5 too.

Try search with google and you'll find couple of hundred
hits about this. You might wanna try find out what cache
preventing headers work for IE..it seems to be very picky about them.

Dear Sniper and Rasmus.
I understand your position. As I stated it in my report, everybody THINKS that it's an IE bug, but in fact it isn't.
And I'm gonna proove it:
I sniffed the output of bird.php, after a request made with Netscape 7.0. The same bug appears: there is a string like "c00\r\n" before the datas: "GIF89a2...". However, Netscape is more clever than IE and they knew about that bug, so they look for this string and forget it when it comes, so that we can correctly save the gif file.
If it doesn't come with Netscape 4.7x, it's because they use the HTTP/1.0 protocol, and the bug comes only when you use an HTTP/1.1 request.
In fact I tried the request with a web client I made myself. When I sniff the output of bird.php, the same appears: "c00\r\n". This was with windows XP. So I tried with a windows 98 station. The same happens: with IE or my self made program, the "c00\r\n" string comes out.
This confirms that it's not an IE bug.
However, perhaps it's an Apache bug, or even something else. I try to find it out, but what I'm sure of, it's that it's not IE, but really PHP/Apache.

The only thing that disturbes me a bit, Rasmus, it's that you looked at the output too, but hadn't this strange string before the datas. Nevertheless, you made an HTTP/1.1 request, and this is the first time I see this, so I don't understand. Could you tell me what program you used to sniff the output ? And what OS do you have ?
I personnally used Ethereal to sniff the datas. Perhaps it's a malformed TCP packet that shows the wrong start of the datas.
Please try it with Ethereal, and you'll see it!
Any clue ?

That c00\r\n is the HTTP chunk size which IE damn well better understand.  And it is supposed to be there.  That's not a bug at all.  Read up on HTTP chunking please.

Dear Rasmus,

Thank you, I didn't know about that HTTP chunking.
So I agree that it's probably an IE bug now, sorry for the insistence.
To summarize, let's avoid sending Cache-Control header along with a picture, and everything will work fine. I think this might help some others. We can use these ones instead:
  header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
  header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
  header("Pragma: no-cache");