Fix bug #70480 (php_url_parse_ex() buffer overflow read)

(cherry picked from commit 629e4da7cc8b174acdeab84969cbfc606a019b31)

diff --git a/ext/standard/url.c b/ext/standard/url.c
index fc3f080a41b6f581e88c43595f72a063cfda0ec5..b5739f0d7aeca6817cafcf3d1030ebae5f95e2f5 100644 (file)
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -320,7 +320,7 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
        nohost:
 
        if ((p = memchr(s, '?', (ue - s)))) {
-               pp = strchr(s, '#');
+               pp = memchr(s, '#', (ue - s));
 
                if (pp && pp < p) {
                        if (pp - s) {