Fixed bug #54180 (parse_url() incorrectly parses path when ? in fragment)

diff --git a/ext/standard/tests/url/bug54180.phpt b/ext/standard/tests/url/bug54180.phpt
new file mode 100644 (file)
index 0000000..2e64e27
--- /dev/null
+++ b/ext/standard/tests/url/bug54180.phpt
@@ -0,0 +1,32 @@
+--TEST--
+Bug #54180 (parse_url() incorrectly parses path when ? in fragment)
+--FILE--
+<?php
+
+var_dump(parse_url("http://example.com/path/script.html?t=1#fragment?data"));
+var_dump(parse_url("http://example.com/path/script.html#fragment?data"));
+
+?>
+--EXPECTF--
+array(5) {
+  ["scheme"]=>
+  string(4) "http"
+  ["host"]=>
+  string(11) "example.com"
+  ["path"]=>
+  string(17) "/path/script.html"
+  ["query"]=>
+  string(3) "t=1"
+  ["fragment"]=>
+  string(13) "fragment?data"
+}
+array(4) {
+  ["scheme"]=>
+  string(4) "http"
+  ["host"]=>
+  string(11) "example.com"
+  ["path"]=>
+  string(17) "/path/script.html"
+  ["fragment"]=>
+  string(13) "fragment?data"
+}

diff --git a/ext/standard/url.c b/ext/standard/url.c
index 29ebbb7699073ce6381fbd2913a83505a1fb95a4..e516f15982186897ee7b2a34cba7dee9962369ec 100644 (file)
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -316,6 +316,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
                pp = strchr(s, '#');
 
                if (pp && pp < p) {
+                       if (pp - s) {
+                               ret->path = estrndup(s, (pp-s));
+                               php_replace_controlchars_ex(ret->path, (pp - s));
+                       }
                        p = pp;
                        goto label_parse;
                }