MFH: Fixed bug #29333 (output_buffering + trans_sess_id can corrupt output)

diff --git a/NEWS b/NEWS
index 24bce305fb5de2e78f831bbb9324350f76a279a9..0bd9db2e4384830489510739fda914524ada38c7 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,7 @@ PHP 4                                                                      NEWS
 - Updated PCRE to provide better error handling in certain cases. (Andrei)
 - NSAPI: added "bucket" parameter to list of non-php.ini-keys of php4_execute
   for doing performance stats without warnings in server-log. (Uwe Schindler)
+- Fixed bug #29333 (output_buffering+trans_sess_id can corrupt output). (Ilia)
 - Fixed bug #29226 (ctype_* functions missing validation of numeric string 
   representations). (Ilia)
 - Fixed bug #29209 (imap_fetchbody() doesn't check message index). (Ilia,

diff --git a/ext/standard/url_scanner_ex.c b/ext/standard/url_scanner_ex.c
index 4e83fb2c5a98afec328a4efc70bbcaffa25a93a1..bf400303a5ba16fc001391bebaf13b932d7ef60c 100644 (file)
--- a/ext/standard/url_scanner_ex.c
+++ b/ext/standard/url_scanner_ex.c
@@ -1,5 +1,5 @@
-/* Generated by re2c 0.5 on Wed Feb 11 11:33:22 2004 */
-#line 1 "/home/php4/ext/standard/url_scanner_ex.re"
+/* Generated by re2c 0.5 on Thu Jul 22 21:53:53 2004 */
+#line 1 "/home/rei/php4/ext/standard/url_scanner_ex.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 4                                                        |
@@ -917,16 +917,31 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char *
 {
        size_t len;
 
-    if (BG(url_adapt_state_ex).url_app.len != 0) {
-        *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC);
+       if (BG(url_adapt_state_ex).url_app.len != 0) {
+               *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC);
                if (sizeof(uint) < sizeof(size_t)) {
                        if (len > UINT_MAX)
                                len = UINT_MAX;
                }
                *handled_output_len = len;
-    } else {
-        *handled_output = NULL;
-    }
+       } else if (BG(url_adapt_state_ex).url_app.len == 0) {
+               url_adapt_state_ex_t *ctx = &BG(url_adapt_state_ex);
+               if (ctx->buf.len) {
+                       smart_str_appendl(&ctx->result, ctx->buf.c, ctx->buf.len);
+                       smart_str_appendl(&ctx->result, output, output_len);
+
+                       *handled_output = ctx->result.c;
+                       *handled_output_len = ctx->buf.len + output_len;
+
+                       ctx->result.c = NULL;
+                       ctx->result.len = 0;
+                       smart_str_free(&ctx->buf);
+               } else {
+                       *handled_output = NULL;
+               }
+       } else {
+               *handled_output = NULL;
+       }
 }
 
 int php_url_scanner_add_var(char *name, int name_len, char *value, int value_len, int urlencode TSRMLS_DC)

diff --git a/ext/standard/url_scanner_ex.re b/ext/standard/url_scanner_ex.re
index c45c9305419f582c8cdec785cbdae6d4721bca49..dc396649b7b24a95c9238a3d7dc7622a6a1aa66b 100644 (file)
--- a/ext/standard/url_scanner_ex.re
+++ b/ext/standard/url_scanner_ex.re
@@ -416,16 +416,31 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char *
 {
        size_t len;
 
-    if (BG(url_adapt_state_ex).url_app.len != 0) {
-        *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC);
+       if (BG(url_adapt_state_ex).url_app.len != 0) {
+               *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC);
                if (sizeof(uint) < sizeof(size_t)) {
                        if (len > UINT_MAX)
                                len = UINT_MAX;
                }
                *handled_output_len = len;
-    } else {
-        *handled_output = NULL;
-    }
+       } else if (BG(url_adapt_state_ex).url_app.len == 0) {
+               url_adapt_state_ex_t *ctx = &BG(url_adapt_state_ex);
+               if (ctx->buf.len) {
+                       smart_str_appendl(&ctx->result, ctx->buf.c, ctx->buf.len);
+                       smart_str_appendl(&ctx->result, output, output_len);
+
+                       *handled_output = ctx->result.c;
+                       *handled_output_len = ctx->buf.len + output_len;
+
+                       ctx->result.c = NULL;
+                       ctx->result.len = 0;
+                       smart_str_free(&ctx->buf);
+               } else {
+                       *handled_output = NULL;
+               }
+       } else {
+               *handled_output = NULL;
+       }
 }
 
 int php_url_scanner_add_var(char *name, int name_len, char *value, int value_len, int urlencode TSRMLS_DC)