fix bug #74780 parse_url() borken when query string contains colon

diff --git a/NEWS b/NEWS
index f2a907b7c4640c1caa4150bccc1284295212499f..7a5194087aa02f802b33825dcefc216398fc6147 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,7 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2017 PHP 7.0.22
 
-
+- Core:
+  . Fixed bug #74780 (parse_url() borken when query string contains colon). 
+    (jhdxr)
 
 06 Jul 2017 PHP 7.0.21
 

diff --git a/ext/standard/tests/url/bug74780.phpt b/ext/standard/tests/url/bug74780.phpt
new file mode 100644 (file)
index 0000000..ae464d9
--- /dev/null
+++ b/ext/standard/tests/url/bug74780.phpt
@@ -0,0 +1,38 @@
+--TEST--
+Bug #74780     parse_url() borks when query string contains colon
+--FILE--
+<?php
+var_dump(
+    parse_url('//php.net/path?query=1:2'),
+    parse_url('//php.net/path.php?query=a:b'),
+    parse_url('//username@php.net/path?query=1:2')
+);
+
+?>
+--EXPECT--
+array(3) {
+  ["host"]=>
+  string(7) "php.net"
+  ["path"]=>
+  string(5) "/path"
+  ["query"]=>
+  string(9) "query=1:2"
+}
+array(3) {
+  ["host"]=>
+  string(7) "php.net"
+  ["path"]=>
+  string(9) "/path.php"
+  ["query"]=>
+  string(9) "query=a:b"
+}
+array(4) {
+  ["host"]=>
+  string(7) "php.net"
+  ["user"]=>
+  string(8) "username"
+  ["path"]=>
+  string(5) "/path"
+  ["query"]=>
+  string(9) "query=1:2"
+}
\ No newline at end of file

diff --git a/ext/standard/url.c b/ext/standard/url.c
index 86f8c45563d29e418c1c0daa386d829706203dd4..9c42afbdeac7212f15ae0bbf90bc4c87848c0ff6 100644 (file)
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -112,6 +112,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, size_t length)
                        if (!isalpha(*p) && !isdigit(*p) && *p != '+' && *p != '.' && *p != '-') {
                                if (e + 1 < ue && e < s + strcspn(s, "?#")) {
                                        goto parse_port;
+                               } else if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
+                                       s += 2;
+                                       e = 0;
+                                       goto parse_host;
                                } else {
                                        goto just_path;
                                }
@@ -208,6 +212,7 @@ PHPAPI php_url *php_url_parse_ex(char const *str, size_t length)
                goto just_path;
        }
 
+       parse_host:
        /* Binary-safe strcspn(s, "/?#") */
        e = ue;
        if ((p = memchr(s, '/', e - s))) {