Fix memory errors in url rewriter

Strings aren't terminated here...

diff --git a/ext/standard/url_scanner_ex.c b/ext/standard/url_scanner_ex.c
index b6663bb9031005d7e4174aab3e1af5e3da81b0c1..4469bb5e08cb6fc4f591a4fffda734d7fc9d1e16 100644 (file)
--- a/ext/standard/url_scanner_ex.c
+++ b/ext/standard/url_scanner_ex.c
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.14.3 */
+/* Generated by re2c 0.16 */
 #line 1 "ext/standard/url_scanner_ex.re"
 /*
   +----------------------------------------------------------------------+
@@ -35,6 +35,7 @@
 
 #include "php_ini.h"
 #include "php_globals.h"
+#include "php_string.h"
 #define STATE_TAG SOME_OTHER_STATE_TAG
 #include "basic_functions.h"
 #include "url.h"
@@ -100,7 +101,7 @@ PHP_INI_BEGIN()
        STD_PHP_INI_ENTRY("url_rewriter.tags", "a=href,area=href,frame=src,form=,fieldset=", PHP_INI_ALL, OnUpdateTags, url_adapt_state_ex, php_basic_globals, basic_globals)
 PHP_INI_END()
 
-#line 107 "ext/standard/url_scanner_ex.re"
+#line 108 "ext/standard/url_scanner_ex.re"
 
 
 #define YYFILL(n) goto done
@@ -119,7 +120,8 @@ static inline void append_modified_url(smart_str *url, smart_str *dest, smart_st
         * Don't modify "//example.com" full path, unless
         * HTTP_HOST matches.
         */
-       if (ZSTR_VAL(url->s)[0] == '/' && ZSTR_VAL(url->s)[1] == '/') {
+       if (ZSTR_LEN(url->s) > 2 && ZSTR_VAL(url->s)[0] == '/' && ZSTR_VAL(url->s)[1] == '/') {
+               const char *end_chars = "/\"'?>\r\n";
                zval *tmp = NULL, *http_host = NULL;
                size_t target_len, host_len;
                if ((!(tmp = zend_hash_str_find(&EG(symbol_table), ZEND_STRL("_SERVER"))))
@@ -129,10 +131,13 @@ static inline void append_modified_url(smart_str *url, smart_str *dest, smart_st
                        smart_str_append_smart_str(dest, url);
                        return;
                }
+
                /* HTTP_HOST could be "example.com:8888", etc. */
                /* Need to find end of URL in buffer */
                host_len   = strcspn(Z_STRVAL_P(http_host), ":");
-               target_len = strcspn(ZSTR_VAL(url->s)+2, "/\"'?>\r\n");
+               target_len = php_strcspn(
+                       ZSTR_VAL(url->s) + 2, (char *) end_chars,
+                       ZSTR_VAL(url->s) + ZSTR_LEN(url->s), (char *) end_chars + strlen(end_chars));
                if (host_len
                        && host_len == target_len
                        && strncasecmp(Z_STRVAL_P(http_host), ZSTR_VAL(url->s)+2, host_len)) {
@@ -145,7 +150,7 @@ static inline void append_modified_url(smart_str *url, smart_str *dest, smart_st
 
 scan:
 
-#line 149 "ext/standard/url_scanner_ex.c"
+#line 154 "ext/standard/url_scanner_ex.c"
 {
        YYCTYPE yych;
        static const unsigned char yybm[] = {
@@ -182,40 +187,41 @@ scan:
                128, 128, 128, 128, 128, 128, 128, 128, 
                128, 128, 128, 128, 128, 128, 128, 128, 
        };
-
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
        if (yybm[0+yych] & 128) {
-               goto yy8;
+               goto yy2;
        }
-       if (yych <= '#') goto yy6;
-       if (yych >= ';') goto yy4;
-       ++YYCURSOR;
-#line 151 "ext/standard/url_scanner_ex.re"
-       { smart_str_append_smart_str(dest, url); return; }
-#line 197 "ext/standard/url_scanner_ex.c"
-yy4:
-       ++YYCURSOR;
-#line 152 "ext/standard/url_scanner_ex.re"
-       { sep = separator; goto scan; }
-#line 202 "ext/standard/url_scanner_ex.c"
-yy6:
-       ++YYCURSOR;
-#line 153 "ext/standard/url_scanner_ex.re"
-       { bash = p - 1; goto done; }
-#line 207 "ext/standard/url_scanner_ex.c"
-yy8:
+       if (yych <= '#') goto yy5;
+       if (yych <= ':') goto yy7;
+       goto yy9;
+yy2:
        ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
        if (yybm[0+yych] & 128) {
-               goto yy8;
+               goto yy2;
        }
-#line 154 "ext/standard/url_scanner_ex.re"
+#line 159 "ext/standard/url_scanner_ex.re"
        { goto scan; }
-#line 217 "ext/standard/url_scanner_ex.c"
+#line 208 "ext/standard/url_scanner_ex.c"
+yy5:
+       ++YYCURSOR;
+#line 158 "ext/standard/url_scanner_ex.re"
+       { bash = p - 1; goto done; }
+#line 213 "ext/standard/url_scanner_ex.c"
+yy7:
+       ++YYCURSOR;
+#line 156 "ext/standard/url_scanner_ex.re"
+       { smart_str_append_smart_str(dest, url); return; }
+#line 218 "ext/standard/url_scanner_ex.c"
+yy9:
+       ++YYCURSOR;
+#line 157 "ext/standard/url_scanner_ex.re"
+       { sep = separator; goto scan; }
+#line 223 "ext/standard/url_scanner_ex.c"
 }
-#line 155 "ext/standard/url_scanner_ex.re"
+#line 160 "ext/standard/url_scanner_ex.re"
 
 done:
 
@@ -400,7 +406,7 @@ state_plain_begin:
 state_plain:
        start = YYCURSOR;
 
-#line 404 "ext/standard/url_scanner_ex.c"
+#line 410 "ext/standard/url_scanner_ex.c"
 {
        YYCTYPE yych;
        static const unsigned char yybm[] = {
@@ -440,30 +446,32 @@ state_plain:
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
        if (yybm[0+yych] & 128) {
-               goto yy15;
+               goto yy13;
        }
-       ++YYCURSOR;
-#line 339 "ext/standard/url_scanner_ex.re"
-       { passthru(STD_ARGS); STATE = STATE_TAG; goto state_tag; }
-#line 449 "ext/standard/url_scanner_ex.c"
-yy15:
+       goto yy16;
+yy13:
        ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
        if (yybm[0+yych] & 128) {
-               goto yy15;
+               goto yy13;
        }
-#line 340 "ext/standard/url_scanner_ex.re"
+#line 345 "ext/standard/url_scanner_ex.re"
        { passthru(STD_ARGS); goto state_plain; }
-#line 459 "ext/standard/url_scanner_ex.c"
+#line 462 "ext/standard/url_scanner_ex.c"
+yy16:
+       ++YYCURSOR;
+#line 344 "ext/standard/url_scanner_ex.re"
+       { passthru(STD_ARGS); STATE = STATE_TAG; goto state_tag; }
+#line 467 "ext/standard/url_scanner_ex.c"
 }
-#line 341 "ext/standard/url_scanner_ex.re"
+#line 346 "ext/standard/url_scanner_ex.re"
 
 
 state_tag:
        start = YYCURSOR;
 
-#line 467 "ext/standard/url_scanner_ex.c"
+#line 475 "ext/standard/url_scanner_ex.c"
 {
        YYCTYPE yych;
        static const unsigned char yybm[] = {
@@ -500,39 +508,27 @@ state_tag:
                  0,   0,   0,   0,   0,   0,   0,   0, 
                  0,   0,   0,   0,   0,   0,   0,   0, 
        };
-       if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+       if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-       if (yych <= '@') {
-               if (yych != ':') goto yy22;
-       } else {
-               if (yych <= 'Z') goto yy20;
-               if (yych <= '`') goto yy22;
-               if (yych >= '{') goto yy22;
+       if (yybm[0+yych] & 128) {
+               goto yy22;
        }
-yy20:
        ++YYCURSOR;
-       yych = *YYCURSOR;
-       goto yy25;
-yy21:
-#line 346 "ext/standard/url_scanner_ex.re"
-       { handle_tag(STD_ARGS); /* Sets STATE */; passthru(STD_ARGS); if (STATE == STATE_PLAIN) goto state_plain; else goto state_next_arg; }
+#line 352 "ext/standard/url_scanner_ex.re"
+       { passthru(STD_ARGS); goto state_plain_begin; }
 #line 520 "ext/standard/url_scanner_ex.c"
 yy22:
        ++YYCURSOR;
-#line 347 "ext/standard/url_scanner_ex.re"
-       { passthru(STD_ARGS); goto state_plain_begin; }
-#line 525 "ext/standard/url_scanner_ex.c"
-yy24:
-       ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-yy25:
        if (yybm[0+yych] & 128) {
-               goto yy24;
+               goto yy22;
        }
-       goto yy21;
+#line 351 "ext/standard/url_scanner_ex.re"
+       { handle_tag(STD_ARGS); /* Sets STATE */; passthru(STD_ARGS); if (STATE == STATE_PLAIN) goto state_plain; else goto state_next_arg; }
+#line 530 "ext/standard/url_scanner_ex.c"
 }
-#line 348 "ext/standard/url_scanner_ex.re"
+#line 353 "ext/standard/url_scanner_ex.re"
 
 
 state_next_arg_begin:
@@ -541,7 +537,7 @@ state_next_arg_begin:
 state_next_arg:
        start = YYCURSOR;
 
-#line 545 "ext/standard/url_scanner_ex.c"
+#line 541 "ext/standard/url_scanner_ex.c"
 {
        YYCTYPE yych;
        static const unsigned char yybm[] = {
@@ -580,78 +576,57 @@ state_next_arg:
        };
        if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
        yych = *YYCURSOR;
-       if (yych <= '.') {
-               if (yych <= '\f') {
-                       if (yych <= 0x08) goto yy36;
-                       if (yych <= '\v') goto yy32;
-                       goto yy36;
-               } else {
-                       if (yych <= '\r') goto yy32;
-                       if (yych == ' ') goto yy32;
-                       goto yy36;
-               }
+       if (yybm[0+yych] & 128) {
+               goto yy29;
+       }
+       if (yych <= '>') {
+               if (yych == '/') goto yy32;
+               if (yych >= '>') goto yy33;
        } else {
-               if (yych <= '@') {
-                       if (yych <= '/') goto yy28;
-                       if (yych == '>') goto yy30;
-                       goto yy36;
+               if (yych <= 'Z') {
+                       if (yych >= 'A') goto yy35;
                } else {
-                       if (yych <= 'Z') goto yy34;
-                       if (yych <= '`') goto yy36;
-                       if (yych <= 'z') goto yy34;
-                       goto yy36;
+                       if (yych <= '`') goto yy27;
+                       if (yych <= 'z') goto yy35;
                }
        }
-yy28:
+yy27:
        ++YYCURSOR;
-       if ((yych = *YYCURSOR) == '>') goto yy39;
-yy29:
-#line 359 "ext/standard/url_scanner_ex.re"
+yy28:
+#line 364 "ext/standard/url_scanner_ex.re"
        { passthru(STD_ARGS); goto state_plain_begin; }
-#line 612 "ext/standard/url_scanner_ex.c"
-yy30:
-       ++YYCURSOR;
-yy31:
-#line 356 "ext/standard/url_scanner_ex.re"
-       { passthru(STD_ARGS); handle_form(STD_ARGS); goto state_plain_begin; }
-#line 618 "ext/standard/url_scanner_ex.c"
-yy32:
-       ++YYCURSOR;
-       yych = *YYCURSOR;
-       goto yy38;
-yy33:
-#line 357 "ext/standard/url_scanner_ex.re"
-       { passthru(STD_ARGS); goto state_next_arg; }
-#line 626 "ext/standard/url_scanner_ex.c"
-yy34:
-       ++YYCURSOR;
-#line 358 "ext/standard/url_scanner_ex.re"
-       { --YYCURSOR; STATE = STATE_ARG; goto state_arg; }
-#line 631 "ext/standard/url_scanner_ex.c"
-yy36:
-       yych = *++YYCURSOR;
-       goto yy29;
-yy37:
+#line 599 "ext/standard/url_scanner_ex.c"
+yy29:
        ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-yy38:
        if (yybm[0+yych] & 128) {
-               goto yy37;
+               goto yy29;
        }
-       goto yy33;
-yy39:
+#line 362 "ext/standard/url_scanner_ex.re"
+       { passthru(STD_ARGS); goto state_next_arg; }
+#line 609 "ext/standard/url_scanner_ex.c"
+yy32:
+       yych = *++YYCURSOR;
+       if (yych != '>') goto yy28;
+yy33:
        ++YYCURSOR;
-       yych = *YYCURSOR;
-       goto yy31;
+#line 361 "ext/standard/url_scanner_ex.re"
+       { passthru(STD_ARGS); handle_form(STD_ARGS); goto state_plain_begin; }
+#line 617 "ext/standard/url_scanner_ex.c"
+yy35:
+       ++YYCURSOR;
+#line 363 "ext/standard/url_scanner_ex.re"
+       { --YYCURSOR; STATE = STATE_ARG; goto state_arg; }
+#line 622 "ext/standard/url_scanner_ex.c"
 }
-#line 360 "ext/standard/url_scanner_ex.re"
+#line 365 "ext/standard/url_scanner_ex.re"
 
 
 state_arg:
        start = YYCURSOR;
 
-#line 655 "ext/standard/url_scanner_ex.c"
+#line 630 "ext/standard/url_scanner_ex.c"
 {
        YYCTYPE yych;
        static const unsigned char yybm[] = {
@@ -688,42 +663,35 @@ state_arg:
                  0,   0,   0,   0,   0,   0,   0,   0, 
                  0,   0,   0,   0,   0,   0,   0,   0, 
        };
-       if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
-       yych = *YYCURSOR;
-       if (yych <= '@') goto yy44;
-       if (yych <= 'Z') goto yy42;
-       if (yych <= '`') goto yy44;
-       if (yych >= '{') goto yy44;
-yy42:
-       ++YYCURSOR;
+       if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-       goto yy47;
-yy43:
-#line 365 "ext/standard/url_scanner_ex.re"
-       { passthru(STD_ARGS); handle_arg(STD_ARGS); STATE = STATE_BEFORE_VAL; goto state_before_val; }
-#line 705 "ext/standard/url_scanner_ex.c"
-yy44:
+       if (yych <= '@') goto yy39;
+       if (yych <= 'Z') goto yy41;
+       if (yych <= '`') goto yy39;
+       if (yych <= 'z') goto yy41;
+yy39:
        ++YYCURSOR;
-#line 366 "ext/standard/url_scanner_ex.re"
+#line 371 "ext/standard/url_scanner_ex.re"
        { passthru(STD_ARGS); STATE = STATE_NEXT_ARG; goto state_next_arg; }
-#line 710 "ext/standard/url_scanner_ex.c"
-yy46:
+#line 677 "ext/standard/url_scanner_ex.c"
+yy41:
        ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-yy47:
        if (yybm[0+yych] & 128) {
-               goto yy46;
+               goto yy41;
        }
-       goto yy43;
+#line 370 "ext/standard/url_scanner_ex.re"
+       { passthru(STD_ARGS); handle_arg(STD_ARGS); STATE = STATE_BEFORE_VAL; goto state_before_val; }
+#line 687 "ext/standard/url_scanner_ex.c"
 }
-#line 367 "ext/standard/url_scanner_ex.re"
+#line 372 "ext/standard/url_scanner_ex.re"
 
 
 state_before_val:
        start = YYCURSOR;
 
-#line 727 "ext/standard/url_scanner_ex.c"
+#line 695 "ext/standard/url_scanner_ex.c"
 {
        YYCTYPE yych;
        static const unsigned char yybm[] = {
@@ -762,54 +730,44 @@ state_before_val:
        };
        if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
        yych = *YYCURSOR;
-       if (yych == ' ') goto yy50;
-       if (yych == '=') goto yy52;
-       goto yy54;
-yy50:
-       yych = *(YYMARKER = ++YYCURSOR);
-       if (yych == ' ') goto yy57;
-       if (yych == '=') goto yy55;
-yy51:
-#line 373 "ext/standard/url_scanner_ex.re"
-       { --YYCURSOR; goto state_next_arg_begin; }
-#line 776 "ext/standard/url_scanner_ex.c"
-yy52:
+       if (yych == ' ') goto yy48;
+       if (yych == '=') goto yy49;
        ++YYCURSOR;
-       yych = *YYCURSOR;
-       goto yy56;
-yy53:
-#line 372 "ext/standard/url_scanner_ex.re"
-       { passthru(STD_ARGS); STATE = STATE_VAL; goto state_val; }
-#line 784 "ext/standard/url_scanner_ex.c"
-yy54:
-       yych = *++YYCURSOR;
-       goto yy51;
-yy55:
+yy47:
+#line 378 "ext/standard/url_scanner_ex.re"
+       { --YYCURSOR; goto state_next_arg_begin; }
+#line 740 "ext/standard/url_scanner_ex.c"
+yy48:
+       yych = *(YYMARKER = ++YYCURSOR);
+       if (yych == ' ') goto yy52;
+       if (yych != '=') goto yy47;
+yy49:
        ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-yy56:
        if (yybm[0+yych] & 128) {
-               goto yy55;
+               goto yy49;
        }
-       goto yy53;
-yy57:
+#line 377 "ext/standard/url_scanner_ex.re"
+       { passthru(STD_ARGS); STATE = STATE_VAL; goto state_val; }
+#line 754 "ext/standard/url_scanner_ex.c"
+yy52:
        ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-       if (yych == ' ') goto yy57;
-       if (yych == '=') goto yy55;
+       if (yych == ' ') goto yy52;
+       if (yych == '=') goto yy49;
        YYCURSOR = YYMARKER;
-       goto yy51;
+       goto yy47;
 }
-#line 374 "ext/standard/url_scanner_ex.re"
+#line 379 "ext/standard/url_scanner_ex.re"
 
 
 
 state_val:
        start = YYCURSOR;
 
-#line 813 "ext/standard/url_scanner_ex.c"
+#line 771 "ext/standard/url_scanner_ex.c"
 {
        YYCTYPE yych;
        static const unsigned char yybm[] = {
@@ -817,7 +775,7 @@ state_val:
                224, 192, 192, 224, 224, 192, 224, 224, 
                224, 224, 224, 224, 224, 224, 224, 224, 
                224, 224, 224, 224, 224, 224, 224, 224, 
-               192, 224,  64, 224, 224, 224, 224, 128, 
+               192, 224, 128, 224, 224, 224, 224,  64, 
                224, 224, 224, 224, 224, 224, 224, 224, 
                224, 224, 224, 224, 224, 224, 224, 224, 
                224, 224, 224, 224, 224, 224,   0, 224, 
@@ -848,87 +806,69 @@ state_val:
        };
        if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
        yych = *YYCURSOR;
-       if (yych <= ' ') {
-               if (yych <= '\f') {
-                       if (yych <= 0x08) goto yy65;
-                       if (yych <= '\n') goto yy67;
-                       goto yy65;
-               } else {
-                       if (yych <= '\r') goto yy67;
-                       if (yych <= 0x1F) goto yy65;
-                       goto yy67;
-               }
-       } else {
-               if (yych <= '&') {
-                       if (yych != '"') goto yy65;
-               } else {
-                       if (yych <= '\'') goto yy64;
-                       if (yych == '>') goto yy67;
-                       goto yy65;
-               }
+       if (yybm[0+yych] & 32) {
+               goto yy57;
        }
-       yych = *(YYMARKER = ++YYCURSOR);
-       if (yych != '>') goto yy76;
-yy63:
-#line 383 "ext/standard/url_scanner_ex.re"
-       { passthru(STD_ARGS); goto state_next_arg_begin; }
-#line 876 "ext/standard/url_scanner_ex.c"
-yy64:
-       yych = *(YYMARKER = ++YYCURSOR);
-       if (yych == '>') goto yy63;
-       goto yy71;
-yy65:
-       ++YYCURSOR;
-       yych = *YYCURSOR;
-       goto yy69;
-yy66:
-#line 382 "ext/standard/url_scanner_ex.re"
-       { handle_val(STD_ARGS, 0, ' '); goto state_next_arg_begin; }
-#line 888 "ext/standard/url_scanner_ex.c"
-yy67:
-       yych = *++YYCURSOR;
-       goto yy63;
-yy68:
+       if (yych <= ' ') goto yy60;
+       if (yych <= '"') goto yy62;
+       if (yych <= '\'') goto yy63;
+       goto yy60;
+yy57:
        ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-yy69:
        if (yybm[0+yych] & 32) {
-               goto yy68;
+               goto yy57;
        }
-       goto yy66;
-yy70:
+#line 387 "ext/standard/url_scanner_ex.re"
+       { handle_val(STD_ARGS, 0, ' '); goto state_next_arg_begin; }
+#line 826 "ext/standard/url_scanner_ex.c"
+yy60:
+       ++YYCURSOR;
+yy61:
+#line 388 "ext/standard/url_scanner_ex.re"
+       { passthru(STD_ARGS); goto state_next_arg_begin; }
+#line 832 "ext/standard/url_scanner_ex.c"
+yy62:
+       yych = *(YYMARKER = ++YYCURSOR);
+       if (yych == '>') goto yy61;
+       goto yy65;
+yy63:
+       yych = *(YYMARKER = ++YYCURSOR);
+       if (yych == '>') goto yy61;
+       goto yy70;
+yy64:
        ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-yy71:
+yy65:
        if (yybm[0+yych] & 64) {
-               goto yy70;
+               goto yy64;
        }
-       if (yych <= '\'') goto yy73;
-yy72:
+       if (yych <= '"') goto yy67;
+yy66:
        YYCURSOR = YYMARKER;
-       goto yy63;
-yy73:
+       goto yy61;
+yy67:
        ++YYCURSOR;
-#line 381 "ext/standard/url_scanner_ex.re"
-       { handle_val(STD_ARGS, 1, '\''); goto state_next_arg_begin; }
-#line 917 "ext/standard/url_scanner_ex.c"
-yy75:
+#line 385 "ext/standard/url_scanner_ex.re"
+       { handle_val(STD_ARGS, 1, '"'); goto state_next_arg_begin; }
+#line 857 "ext/standard/url_scanner_ex.c"
+yy69:
        ++YYCURSOR;
        if (YYLIMIT <= YYCURSOR) YYFILL(1);
        yych = *YYCURSOR;
-yy76:
+yy70:
        if (yybm[0+yych] & 128) {
-               goto yy75;
+               goto yy69;
        }
-       if (yych >= '#') goto yy72;
+       if (yych >= '(') goto yy66;
        ++YYCURSOR;
-#line 380 "ext/standard/url_scanner_ex.re"
-       { handle_val(STD_ARGS, 1, '"'); goto state_next_arg_begin; }
-#line 930 "ext/standard/url_scanner_ex.c"
+#line 386 "ext/standard/url_scanner_ex.re"
+       { handle_val(STD_ARGS, 1, '\''); goto state_next_arg_begin; }
+#line 870 "ext/standard/url_scanner_ex.c"
 }
-#line 384 "ext/standard/url_scanner_ex.re"
+#line 389 "ext/standard/url_scanner_ex.re"
 
 
 stop:

diff --git a/ext/standard/url_scanner_ex.re b/ext/standard/url_scanner_ex.re
index a5cf50eac34aec252320d95ff1ef5a4c9f2576f0..8bc77db4be67098808365f0e89714659ca95e2ab 100644 (file)
--- a/ext/standard/url_scanner_ex.re
+++ b/ext/standard/url_scanner_ex.re
@@ -33,6 +33,7 @@
 
 #include "php_ini.h"
 #include "php_globals.h"
+#include "php_string.h"
 #define STATE_TAG SOME_OTHER_STATE_TAG
 #include "basic_functions.h"
 #include "url.h"
@@ -122,7 +123,8 @@ static inline void append_modified_url(smart_str *url, smart_str *dest, smart_st
         * Don't modify "//example.com" full path, unless
         * HTTP_HOST matches.
         */
-       if (ZSTR_VAL(url->s)[0] == '/' && ZSTR_VAL(url->s)[1] == '/') {
+       if (ZSTR_LEN(url->s) > 2 && ZSTR_VAL(url->s)[0] == '/' && ZSTR_VAL(url->s)[1] == '/') {
+               const char *end_chars = "/\"'?>\r\n";
                zval *tmp = NULL, *http_host = NULL;
                size_t target_len, host_len;
                if ((!(tmp = zend_hash_str_find(&EG(symbol_table), ZEND_STRL("_SERVER"))))
@@ -132,10 +134,13 @@ static inline void append_modified_url(smart_str *url, smart_str *dest, smart_st
                        smart_str_append_smart_str(dest, url);
                        return;
                }
+
                /* HTTP_HOST could be "example.com:8888", etc. */
                /* Need to find end of URL in buffer */
                host_len   = strcspn(Z_STRVAL_P(http_host), ":");
-               target_len = strcspn(ZSTR_VAL(url->s)+2, "/\"'?>\r\n");
+               target_len = php_strcspn(
+                       ZSTR_VAL(url->s) + 2, (char *) end_chars,
+                       ZSTR_VAL(url->s) + ZSTR_LEN(url->s), (char *) end_chars + strlen(end_chars));
                if (host_len
                        && host_len == target_len
                        && strncasecmp(Z_STRVAL_P(http_host), ZSTR_VAL(url->s)+2, host_len)) {