Fix #4928

Be *CAREFUL* with the _ex API, guys!

diff --git a/NEWS b/NEWS
index 4a2e6930a2d6b9eddb1dd2f3b45c0c6721cff6b1..c40f3d5ce9ce59d4f7cb1ef8d055255b47f46bc0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,8 +2,11 @@ PHP 4.0                                                                    NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 
 ?? ??? 2000, Version 4.0.1
-- Parse errors in the php.ini files under Windows will no longer mess up the
-  HTTP headers in CGI mode and are now displayed in a message box (Zeev)
+- Fixed a bug in rawurldecode() that would cause in rawurldecode() corrupting
+  its argument (Zeev)
+- Parse errors (or other errors) in the php.ini files under Windows will no
+  longer mess up the HTTP headers in CGI mode and are now displayed in a
+  message box (Zeev)
 - Fixed a crash in OCIFetchStatement() when trying to read after all data
   has already been read. (Thies)
 - fopen_wrappers() are now extensible via modules (Hartmut Holzgraefe)

diff --git a/ext/standard/url.c b/ext/standard/url.c
index c1e7bf7f3b7c66f2946548d6baa4d125705b3041..9b159d8887c61c772adbb29fb806c75108a94462 100644 (file)
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -391,6 +391,7 @@ PHP_FUNCTION(rawurldecode)
 {
        pval **arg;
        int len;
+       char *str;
 
        if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &arg) == FAILURE) {
                WRONG_PARAM_COUNT;
@@ -400,9 +401,10 @@ PHP_FUNCTION(rawurldecode)
        if (!(*arg)->value.str.len) {
                RETURN_FALSE;
        }
-       len = php_raw_url_decode((*arg)->value.str.val, (*arg)->value.str.len);
+       str = estrndup(Z_STRVAL_PP(arg), Z_STRLEN_PP(arg));
+       len = php_raw_url_decode(str, Z_STRLEN_PP(arg));
 
-       RETVAL_STRINGL((*arg)->value.str.val, len, 1);
+       RETVAL_STRINGL(str, len, 0);
 }
 /* }}} */