svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/standard/tests/url/bug54180.phpt branches/PHP_5_3/ext/standard/url.c
trunk/ext/standard/tests/url/bug54180.phpt trunk/ext/standard/url.c

pierrick Sun, 13 Mar 2011 04:02:56 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=309159 Log: Fixed bug #54180 (parse_url() incorrectly parses path when ? in fragment) Bug: http://bugs.php.net/54180 (Open) parse_url() incorrectly parses path when ? in fragment Changed paths: U php/php-src/branches/PHP_5_3/NEWS A php/php-src/branches/PHP_5_3/ext/standard/tests/url/bug54180.phpt U php/php-src/branches/PHP_5_3/ext/standard/url.c A php/php-src/trunk/ext/standard/tests/url/bug54180.phpt U php/php-src/trunk/ext/standard/url.c Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2011-03-13 03:46:02 UTC (rev 309158) +++ php/php-src/branches/PHP_5_3/NEWS 2011-03-13 04:02:56 UTC (rev 309159) @@ -1,6 +1,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| 10 Mar 2011, PHP 5.3.6RC3 +- Core: + . Fixed bug #54180 (parse_url() incorrectly parses path when ? in fragment). + (tomas dot brastavicius at quantum dot lt, Pierrick) + - Shmop extension: . Fixed bug #54193 (Integer overflow in shmop_read()). (Felipe) Reported by Jose Carlos Norte <jose at eyeos dot org> (CVE-2011-1092) Added: php/php-src/branches/PHP_5_3/ext/standard/tests/url/bug54180.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/tests/url/bug54180.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/standard/tests/url/bug54180.phpt 2011-03-13 04:02:56 UTC (rev 309159) @@ -0,0 +1,32 @@ +--TEST-- +Bug #54180 (parse_url() incorrectly parses path when ? in fragment) +--FILE-- +<?php + +var_dump(parse_url("http://example.com/path/script.html?t=1#fragment?data")); +var_dump(parse_url("http://example.com/path/script.html#fragment?data")); + +?> +--EXPECTF-- +array(5) { + ["scheme"]=> + string(4) "http" + ["host"]=> + string(11) "example.com" + ["path"]=> + string(17) "/path/script.html" + ["query"]=> + string(3) "t=1" + ["fragment"]=> + string(13) "fragment?data" +} +array(4) { + ["scheme"]=> + string(4) "http" + ["host"]=> + string(11) "example.com" + ["path"]=> + string(17) "/path/script.html" + ["fragment"]=> + string(13) "fragment?data" +} Modified: php/php-src/branches/PHP_5_3/ext/standard/url.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/url.c 2011-03-13 03:46:02 UTC (rev 309158) +++ php/php-src/branches/PHP_5_3/ext/standard/url.c 2011-03-13 04:02:56 UTC (rev 309159) @@ -316,6 +316,10 @@ pp = strchr(s, '#'); if (pp && pp < p) { + if (pp - s) { + ret->path = estrndup(s, (pp-s)); + php_replace_controlchars_ex(ret->path, (pp - s)); + } p = pp; goto label_parse; } Added: php/php-src/trunk/ext/standard/tests/url/bug54180.phpt =================================================================== --- php/php-src/trunk/ext/standard/tests/url/bug54180.phpt (rev 0) +++ php/php-src/trunk/ext/standard/tests/url/bug54180.phpt 2011-03-13 04:02:56 UTC (rev 309159) @@ -0,0 +1,32 @@ +--TEST-- +Bug #54180 (parse_url() incorrectly parses path when ? in fragment) +--FILE-- +<?php + +var_dump(parse_url("http://example.com/path/script.html?t=1#fragment?data")); +var_dump(parse_url("http://example.com/path/script.html#fragment?data")); + +?> +--EXPECTF-- +array(5) { + ["scheme"]=> + string(4) "http" + ["host"]=> + string(11) "example.com" + ["path"]=> + string(17) "/path/script.html" + ["query"]=> + string(3) "t=1" + ["fragment"]=> + string(13) "fragment?data" +} +array(4) { + ["scheme"]=> + string(4) "http" + ["host"]=> + string(11) "example.com" + ["path"]=> + string(17) "/path/script.html" + ["fragment"]=> + string(13) "fragment?data" +} Modified: php/php-src/trunk/ext/standard/url.c =================================================================== --- php/php-src/trunk/ext/standard/url.c 2011-03-13 03:46:02 UTC (rev 309158) +++ php/php-src/trunk/ext/standard/url.c 2011-03-13 04:02:56 UTC (rev 309159) @@ -316,6 +316,10 @@ pp = strchr(s, '#'); if (pp && pp < p) { + if (pp - s) { + ret->path = estrndup(s, (pp-s)); + php_replace_controlchars_ex(ret->path, (pp - s)); + } p = pp; goto label_parse; }