- Fix bug #36656 (http_build_query generates invalid URIs due to use of square brackets)

diff --git a/NEWS b/NEWS
index eb2753d99940fa7fdcac49296c7fe88647d871cb..9b23bc0dbe77bad949f2dc995cbff09d6eb29d3b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -48,6 +48,8 @@ PHP                                                                        NEWS
 - Fixed tiger hash algorithm generating wrong results on big endian platforms.
   (Mike)
 - Fixed crash with DOMImplementation::createDocumentType("name:"). (Mike)
+- Fixed bug #36656 (http_build_query generates invalid URIs due to use of 
+  square brackets). (Mike)
 - Fixed bug #36638 (strtotime() returns false when 2nd argument < 1). (Derick)
 - Fixed bug #36625 (pg_trace() does not work). (iakio at mono-space dot net)
 - Fixed bug #36611 (assignment to SimpleXML object attribute changes argument 

diff --git a/ext/standard/http.c b/ext/standard/http.c
index 25ff817b2e004d59d3d6466e4c42891b835ba4d9..35d9135c622d7288bdac42769ba5d0df9a222d5f 100644 (file)
--- a/ext/standard/http.c
+++ b/ext/standard/http.c
@@ -82,7 +82,7 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
                if (Z_TYPE_PP(zdata) == IS_ARRAY || Z_TYPE_PP(zdata) == IS_OBJECT) {
                        if (key_type == HASH_KEY_IS_STRING) {
                                ekey = php_url_encode(key, key_len, &ekey_len);
-                               newprefix_len = key_suffix_len + ekey_len + key_prefix_len + 1;
+                               newprefix_len = key_suffix_len + ekey_len + key_prefix_len + 3 /* %5B */;
                                newprefix = emalloc(newprefix_len + 1);
                                p = newprefix;
 
@@ -99,13 +99,14 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
                                        memcpy(p, key_suffix, key_suffix_len);
                                        p += key_suffix_len;
                                }
-
-                               *(p++) = '[';
+                               *(p++) = '%';
+                               *(p++) = '5';
+                               *(p++) = 'B';
                                *p = '\0';
                        } else {
                                /* Is an integer key */
                                ekey_len = spprintf(&ekey, 12, "%ld", idx);
-                               newprefix_len = key_prefix_len + num_prefix_len + ekey_len + key_suffix_len + 1;
+                               newprefix_len = key_prefix_len + num_prefix_len + ekey_len + key_suffix_len + 3 /* %5B */;
                                newprefix = emalloc(newprefix_len + 1);
                                p = newprefix;
 
@@ -125,11 +126,13 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
                                        memcpy(p, key_suffix, key_suffix_len);
                                        p += key_suffix_len;
                                }
-                               *(p++) = '[';
+                               *(p++) = '%';
+                               *(p++) = '5';
+                               *(p++) = 'B';
                                *p = '\0';
                        }
                        ht->nApplyCount++;
-                       php_url_encode_hash_ex(HASH_OF(*zdata), formstr, NULL, 0, newprefix, newprefix_len, "]", 1, (Z_TYPE_PP(zdata) == IS_OBJECT ? *zdata : NULL), arg_sep TSRMLS_CC);
+                       php_url_encode_hash_ex(HASH_OF(*zdata), formstr, NULL, 0, newprefix, newprefix_len, "%5D", 3, (Z_TYPE_PP(zdata) == IS_OBJECT ? *zdata : NULL), arg_sep TSRMLS_CC);
                        ht->nApplyCount--;
                        efree(newprefix);
                } else if (Z_TYPE_PP(zdata) == IS_NULL || Z_TYPE_PP(zdata) == IS_RESOURCE) {