Fixed off-by-one in php_url_parse_ex

Change order of condition, previously pointer could be derefrenced before
bound check was done.

diff --git a/ext/standard/url.c b/ext/standard/url.c
index fd5bcb402e2d37189de961fedf7197d6e0ea23d8..1c158071e14f6c16db67e43ec60a077bd8b6053d 100644 (file)
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -263,7 +263,7 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
        } else {
                /* memrchr is a GNU specific extension
                   Emulate for wide compatability */
-               for(p = e; *p != ':' && p >= s; p--);
+               for(p = e; p >= s && *p != ':'; p--);
        }
 
        if (p >= s && *p == ':') {