Fixed bug #50073 (parse_url() incorrect when ? in fragment).

diff --git a/NEWS b/NEWS
index 38adc920b327e8215a42adc37bdb42c72aaeb05c..da42349173047eb5a0c2b66b0052cf1a8986a9de 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ PHP                                                                        NEWS
 - Fixed memory leak in extension loading when an error occurs on Windows.
   (Pierre)
 
+- Fixed bug #50073 (parse_url() incorrect when ? in fragment). (Ilia)
 - Fixed bug #50023 (pdo_mysql doesn't use PHP_MYSQL_UNIX_SOCK_ADDR). (Ilia)
 - Fixed bug #49908 (throwing exception in __autoload crashes when interface
   is not defined). (Felipe)

diff --git a/ext/standard/url.c b/ext/standard/url.c
index 61bc393ea1c39328c8f2e7e1c41c389166c9ff94..15c6a11109666ce4dfac036dd3387f02840e703b 100644 (file)
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -201,10 +201,21 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
        e = ue;
        
        if (!(p = memchr(s, '/', (ue - s)))) {
-               if ((p = memchr(s, '?', (ue - s)))) {
-                       e = p;
-               } else if ((p = memchr(s, '#', (ue - s)))) {
-                       e = p;
+               char *query, *fragment;
+
+               query = memchr(s, '?', (ue - s));
+               fragment = memchr(s, '#', (ue - s));
+
+               if (query && fragment) {
+                       if (query > fragment) {
+                               p = e = fragment;
+                       } else {
+                               p = e = query;
+                       }
+               } else if (query) {
+                       p = e = query;
+               } else if (fragment) {
+                       p = e = fragment;
                }
        } else {
                e = p;
@@ -285,10 +296,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
        
        if ((p = memchr(s, '?', (ue - s)))) {
                pp = strchr(s, '#');
-               
+
                if (pp && pp < p) {
                        p = pp;
-                       pp = strchr(pp+2, '#');
+                       goto label_parse;
                }
        
                if (p - s) {