Fix #69976: Unable to parse "all" urls with colon char

If a colon occurs in a query string or fragment of a partial URL without
scheme, parse_url() tries to regard it as port separator. If up to 5 digits
follow and then a slash or the end of the string, parse_url() fails.

We're fixing this by checking whether the colon is part of the query string or
the fragment, under the assumption that question marks and hash signs are only
allowed as separators of query string and fragments, respectively, what is
guarenteed for URIs (RFC 3986), but not necessarily for URLs (RFC 1738) where
question marks are allowed for usernames and passwords.

Anyhow, this constitutes a minor BC, so the fix is applied to master only.

diff --git a/ext/standard/tests/url/bug69976.phpt b/ext/standard/tests/url/bug69976.phpt
new file mode 100644 (file)
index 0000000..8c8ceac
--- /dev/null
+++ b/ext/standard/tests/url/bug69976.phpt
@@ -0,0 +1,34 @@
+--TEST--
+Bug #69976 (Unable to parse "all" urls with colon char)
+--FILE--
+<?php
+var_dump(parse_url("/busca/?fq=B:20001"));
+var_dump(parse_url("/busca/?fq=B:200013"));
+var_dump(parse_url("/busca/?fq=home:01234"));
+var_dump(parse_url("/busca/?fq=home:012345"));
+?>
+--EXPECT--
+array(2) {
+  ["path"]=>
+  string(7) "/busca/"
+  ["query"]=>
+  string(10) "fq=B:20001"
+}
+array(2) {
+  ["path"]=>
+  string(7) "/busca/"
+  ["query"]=>
+  string(11) "fq=B:200013"
+}
+array(2) {
+  ["path"]=>
+  string(7) "/busca/"
+  ["query"]=>
+  string(13) "fq=home:01234"
+}
+array(2) {
+  ["path"]=>
+  string(7) "/busca/"
+  ["query"]=>
+  string(14) "fq=home:012345"
+}

diff --git a/ext/standard/url.c b/ext/standard/url.c
index fe38c2d993343daea06901880488b73f1cd7592c..2531a0ff9a14b196d16145e1359e3ea759c571b7 100644 (file)
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -110,7 +110,7 @@ PHPAPI php_url *php_url_parse_ex(char const *str, size_t length)
                while (p < e) {
                        /* scheme = 1*[ lowalpha | digit | "+" | "-" | "." ] */
                        if (!isalpha(*p) && !isdigit(*p) && *p != '+' && *p != '.' && *p != '-') {
-                               if (e + 1 < ue) {
+                               if (e + 1 < ue && e < s + strcspn(s, "?#")) {
                                        goto parse_port;
                                } else {
                                        goto just_path;