Fixed bug #50073 (parse_url() incorrect when ? in fragment).

diff --git a/NEWS b/NEWS
index b8d3e9575d87d9ff51a74597e2682fcfa591b387..6a034b1933b1b0407414f909d3e06b317bfc2889 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,7 @@ PHP                                                                        NEWS
   (Felipe)
 - Fixed memory leak in openssl_pkcs12_export_to_file(). (Felipe)
 
+- Fixed bug #50073 (parse_url() incorrect when ? in fragment). (Ilia)
 - Fixed bug #50006 (Segfault caused by uksort()). (Felipe)
 - Fixed bug #49990 (SNMP3 warning message about security level printed twice).
   (Jani)

diff --git a/ext/standard/url.c b/ext/standard/url.c
index 11b5eb0d0e3ea0407905a6d7201f98f446d21fb2..cc9cd99052fba2e384041021baa8e72be097ab12 100644 (file)
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -201,10 +201,21 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
        e = ue;
        
        if (!(p = memchr(s, '/', (ue - s)))) {
-               if ((p = memchr(s, '?', (ue - s)))) {
-                       e = p;
-               } else if ((p = memchr(s, '#', (ue - s)))) {
-                       e = p;
+               char *query, *fragment;
+
+               query = memchr(s, '?', (ue - s));
+               fragment = memchr(s, '#', (ue - s));
+
+               if (query && fragment) {
+                       if (query > fragment) {
+                               p = e = fragment;
+                       } else {
+                               p = e = query;
+                       }
+               } else if (query) {
+                       p = e = query;
+               } else if (fragment) {
+                       p = e = fragment;
                }
        } else {
                e = p;
@@ -285,10 +296,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
        
        if ((p = memchr(s, '?', (ue - s)))) {
                pp = strchr(s, '#');
-               
+
                if (pp && pp < p) {
                        p = pp;
-                       pp = strchr(pp+2, '#');
+                       goto label_parse;
                }
        
                if (p - s) {