MFB: Fix bug #36656 (http_build_query generates invalid URIs due to use of square...

diff --git a/ext/standard/http.c b/ext/standard/http.c
index 39217b1c5f04adb251a472212e675a99d80b0a49..9fd6723cdca1c810870ae3663b3b3efbbb826366 100644 (file)
--- a/ext/standard/http.c
+++ b/ext/standard/http.c
@@ -85,7 +85,7 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
                if (Z_TYPE_PP(zdata) == IS_ARRAY || Z_TYPE_PP(zdata) == IS_OBJECT) {
                        if (key_type == HASH_KEY_IS_STRING) {
                                ekey = php_url_encode(key.s, key_len, &ekey_len);
-                               newprefix_len = key_suffix_len + ekey_len + key_prefix_len + 1;
+                               newprefix_len = key_suffix_len + ekey_len + key_prefix_len + 3 /* %5B */;
                                newprefix = emalloc(newprefix_len + 1);
                                p = newprefix;
 
@@ -102,13 +102,14 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
                                        memcpy(p, key_suffix, key_suffix_len);
                                        p += key_suffix_len;
                                }
-
-                               *(p++) = '[';
+                               *(p++) = '%';
+                               *(p++) = '5';
+                               *(p++) = 'B';
                                *p = '\0';
                        } else {
                                /* Is an integer key */
                                ekey_len = spprintf(&ekey, 12, "%ld", idx);
-                               newprefix_len = key_prefix_len + num_prefix_len + ekey_len + key_suffix_len + 1;
+                               newprefix_len = key_prefix_len + num_prefix_len + ekey_len + key_suffix_len + 3 /* %5B */;
                                newprefix = emalloc(newprefix_len + 1);
                                p = newprefix;
 
@@ -128,11 +129,13 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
                                        memcpy(p, key_suffix, key_suffix_len);
                                        p += key_suffix_len;
                                }
-                               *(p++) = '[';
+                               *(p++) = '%';
+                               *(p++) = '5';
+                               *(p++) = 'B';
                                *p = '\0';
                        }
                        ht->nApplyCount++;
-                       php_url_encode_hash_ex(HASH_OF(*zdata), formstr, NULL, 0, newprefix, newprefix_len, "]", 1, (Z_TYPE_PP(zdata) == IS_OBJECT ? *zdata : NULL), arg_sep TSRMLS_CC);
+                       php_url_encode_hash_ex(HASH_OF(*zdata), formstr, NULL, 0, newprefix, newprefix_len, "%5D", 3, (Z_TYPE_PP(zdata) == IS_OBJECT ? *zdata : NULL), arg_sep TSRMLS_CC);
                        ht->nApplyCount--;
                        efree(newprefix);
                } else if (Z_TYPE_PP(zdata) == IS_NULL || Z_TYPE_PP(zdata) == IS_RESOURCE) {