MFH: Fixed bug #29333 (output_buffering + trans_sess_id can corrupt output)

diff --git a/ext/standard/url_scanner_ex.c b/ext/standard/url_scanner_ex.c
index 174afb9ad56c8a49c30157a40723c067775326ae..8ef4c2e355e8ab24d1eba214d0e55cc666fa19c4 100644 (file)
--- a/ext/standard/url_scanner_ex.c
+++ b/ext/standard/url_scanner_ex.c
@@ -987,16 +987,31 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char *
 {
        size_t len;
 
-    if (BG(url_adapt_state_ex).url_app.len != 0) {
-        *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC);
+       if (BG(url_adapt_state_ex).url_app.len != 0) {
+               *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC);
                if (sizeof(uint) < sizeof(size_t)) {
                        if (len > UINT_MAX)
                                len = UINT_MAX;
                }
                *handled_output_len = len;
-    } else {
-        *handled_output = NULL;
-    }
+       } else if (BG(url_adapt_state_ex).url_app.len == 0) {
+               url_adapt_state_ex_t *ctx = &BG(url_adapt_state_ex);
+               if (ctx->buf.len) {
+                       smart_str_appendl(&ctx->result, ctx->buf.c, ctx->buf.len);
+                       smart_str_appendl(&ctx->result, output, output_len);
+
+                       *handled_output = ctx->result.c;
+                       *handled_output_len = ctx->buf.len + output_len;
+
+                       ctx->result.c = NULL;
+                       ctx->result.len = 0;
+                       smart_str_free(&ctx->buf);
+               } else {
+                       *handled_output = NULL;
+               }
+       } else {
+               *handled_output = NULL;
+       }
 }
 
 int php_url_scanner_add_var(char *name, int name_len, char *value, int value_len, int urlencode TSRMLS_DC)

diff --git a/ext/standard/url_scanner_ex.re b/ext/standard/url_scanner_ex.re
index a7d688abcb9d6d2137bc7cfa46a917872248613b..ec02d5ebb8c73a3435bdc4576073b7175f135f7f 100644 (file)
--- a/ext/standard/url_scanner_ex.re
+++ b/ext/standard/url_scanner_ex.re
@@ -416,16 +416,31 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char *
 {
        size_t len;
 
-    if (BG(url_adapt_state_ex).url_app.len != 0) {
-        *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC);
+       if (BG(url_adapt_state_ex).url_app.len != 0) {
+               *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC);
                if (sizeof(uint) < sizeof(size_t)) {
                        if (len > UINT_MAX)
                                len = UINT_MAX;
                }
                *handled_output_len = len;
-    } else {
-        *handled_output = NULL;
-    }
+       } else if (BG(url_adapt_state_ex).url_app.len == 0) {
+               url_adapt_state_ex_t *ctx = &BG(url_adapt_state_ex);
+               if (ctx->buf.len) {
+                       smart_str_appendl(&ctx->result, ctx->buf.c, ctx->buf.len);
+                       smart_str_appendl(&ctx->result, output, output_len);
+
+                       *handled_output = ctx->result.c;
+                       *handled_output_len = ctx->buf.len + output_len;
+
+                       ctx->result.c = NULL;
+                       ctx->result.len = 0;
+                       smart_str_free(&ctx->buf);
+               } else {
+                       *handled_output = NULL;
+               }
+       } else {
+               *handled_output = NULL;
+       }
 }
 
 int php_url_scanner_add_var(char *name, int name_len, char *value, int value_len, int urlencode TSRMLS_DC)