MFH

diff --git a/main/php_variables.c b/main/php_variables.c
index fbf762ee3e6ed2afa3f859b9e9aafd8ec4d0d8ee..d0283cd44f303129245b8955d991f8346f949414 100644 (file)
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -120,7 +120,28 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, pval *track_vars_arra
 
        while (1) {
                if (is_array) {
-                       char *escaped_index;
+                       char *escaped_index = NULL, *index_s;
+                       int new_idx_len = 0;
+
+                       ip++;
+                       index_s = ip;
+                       if (isspace(*ip)) {
+                               ip++;
+                       }
+                       if (*ip==']') {
+                               index_s = NULL;
+                       } else {
+                               ip = strchr(ip, ']');
+                               if (!ip) {
+                                       /* PHP variables cannot contain '[' in their names, so we replace the character with a '_' */
+                                       *(index_s - 1) = '_';
+                                       index_len = var_len = strlen(var);
+                                       goto plain_var;
+                                       return;
+                               }
+                               *ip = 0;
+                               new_idx_len = strlen(index_s);  
+                       }
 
                        if (!index) {
                                MAKE_STD_ZVAL(gpc_element);
@@ -148,22 +169,9 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, pval *track_vars_arra
                        }
                        symtable1 = Z_ARRVAL_PP(gpc_element_p);
                        /* ip pointed to the '[' character, now obtain the key */
-                       index = ++ip;
-                       index_len = 0;
-                       if (*ip=='\n' || *ip=='\r' || *ip=='\t' || *ip==' ') {
-                               ip++;
-                       }
-                       if (*ip==']') {
-                               index = NULL;
-                       } else {
-                               ip = strchr(ip, ']');
-                               if (!ip) {
-                                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Missing ] in %s variable", var);
-                                       return;
-                               }
-                               *ip = 0;
-                               index_len = strlen(index);
-                       }
+                       index = index_s;
+                       index_len = new_idx_len;
+
                        ip++;
                        if (*ip=='[') {
                                is_array = 1;
@@ -172,6 +180,7 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, pval *track_vars_arra
                                is_array = 0;
                        }
                } else {
+plain_var:
                        MAKE_STD_ZVAL(gpc_element);
                        gpc_element->value = val->value;
                        Z_TYPE_P(gpc_element) = Z_TYPE_P(val);

diff --git a/main/rfc1867.c b/main/rfc1867.c
index 60dfc2fe78c5a7bd30c8059b1726bff3044a5b2c..34977a8e8517f9a42eea3ae07114db284c274619 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -104,7 +104,7 @@ static void normalize_protected_variable(char *varname TSRMLS_DC)
 
        /* done? */
        while (index) {
-               
+
                while (*index == ' ' || *index == '\r' || *index == '\n' || *index=='\t') {
                        index++;
                }
@@ -897,8 +897,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
                         * ends in [.*]
                         * start_arr is set to point to 1st [
                         */
-                       is_arr_upload = (start_arr = strchr(param,'[')) &&
-                                                       (param[strlen(param)-1] == ']');
+                       is_arr_upload = (start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
+                       /* handle unterminated [ */
+                       if (!is_arr_upload && start_arr) {
+                               *start_arr = '_';
+                       }
 
                        if (is_arr_upload) {
                                array_len = strlen(start_arr);