From: Ilia Alshanetsky <iliaa@php.net>
Date: Fri, 23 Jul 2004 02:05:55 +0000 (+0000)
Subject: MFH: Fixed bug #29333 (output_buffering + trans_sess_id can corrupt output)
X-Git-Tag: php-4.3.9RC1~26
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2b73a58a4cff56d60b3cebc5339e1135e753e861;p=php

MFH: Fixed bug #29333 (output_buffering + trans_sess_id can corrupt output)
---

diff --git a/NEWS b/NEWS
index 24bce305fb..0bd9db2e43 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,7 @@ PHP 4                                                                      NEWS
 - Updated PCRE to provide better error handling in certain cases. (Andrei)
 - NSAPI: added "bucket" parameter to list of non-php.ini-keys of php4_execute
   for doing performance stats without warnings in server-log. (Uwe Schindler)
+- Fixed bug #29333 (output_buffering+trans_sess_id can corrupt output). (Ilia)
 - Fixed bug #29226 (ctype_* functions missing validation of numeric string 
   representations). (Ilia)
 - Fixed bug #29209 (imap_fetchbody() doesn't check message index). (Ilia,
diff --git a/ext/standard/url_scanner_ex.c b/ext/standard/url_scanner_ex.c
index 4e83fb2c5a..bf400303a5 100644
--- a/ext/standard/url_scanner_ex.c
+++ b/ext/standard/url_scanner_ex.c
@@ -1,5 +1,5 @@
-/* Generated by re2c 0.5 on Wed Feb 11 11:33:22 2004 */
-#line 1 "/home/php4/ext/standard/url_scanner_ex.re"
+/* Generated by re2c 0.5 on Thu Jul 22 21:53:53 2004 */
+#line 1 "/home/rei/php4/ext/standard/url_scanner_ex.re"
 /*
   +----------------------------------------------------------------------+
   | PHP Version 4                                                        |
@@ -917,16 +917,31 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char *
 {
 	size_t len;
 
-    if (BG(url_adapt_state_ex).url_app.len != 0) {
-        *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC);
+	if (BG(url_adapt_state_ex).url_app.len != 0) {
+		*handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC);
 		if (sizeof(uint) < sizeof(size_t)) {
 			if (len > UINT_MAX)
 				len = UINT_MAX;
 		}
 		*handled_output_len = len;
-    } else {
-        *handled_output = NULL;
-    }
+	} else if (BG(url_adapt_state_ex).url_app.len == 0) {
+		url_adapt_state_ex_t *ctx = &BG(url_adapt_state_ex);
+		if (ctx->buf.len) {
+			smart_str_appendl(&ctx->result, ctx->buf.c, ctx->buf.len);
+			smart_str_appendl(&ctx->result, output, output_len);
+
+			*handled_output = ctx->result.c;
+			*handled_output_len = ctx->buf.len + output_len;
+
+			ctx->result.c = NULL;
+			ctx->result.len = 0;
+			smart_str_free(&ctx->buf);
+		} else {
+			*handled_output = NULL;
+		}
+	} else {
+		*handled_output = NULL;
+	}
 }
 
 int php_url_scanner_add_var(char *name, int name_len, char *value, int value_len, int urlencode TSRMLS_DC)
diff --git a/ext/standard/url_scanner_ex.re b/ext/standard/url_scanner_ex.re
index c45c930541..dc396649b7 100644
--- a/ext/standard/url_scanner_ex.re
+++ b/ext/standard/url_scanner_ex.re
@@ -416,16 +416,31 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char *
 {
 	size_t len;
 
-    if (BG(url_adapt_state_ex).url_app.len != 0) {
-        *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC);
+	if (BG(url_adapt_state_ex).url_app.len != 0) {
+		*handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC);
 		if (sizeof(uint) < sizeof(size_t)) {
 			if (len > UINT_MAX)
 				len = UINT_MAX;
 		}
 		*handled_output_len = len;
-    } else {
-        *handled_output = NULL;
-    }
+	} else if (BG(url_adapt_state_ex).url_app.len == 0) {
+		url_adapt_state_ex_t *ctx = &BG(url_adapt_state_ex);
+		if (ctx->buf.len) {
+			smart_str_appendl(&ctx->result, ctx->buf.c, ctx->buf.len);
+			smart_str_appendl(&ctx->result, output, output_len);
+
+			*handled_output = ctx->result.c;
+			*handled_output_len = ctx->buf.len + output_len;
+
+			ctx->result.c = NULL;
+			ctx->result.len = 0;
+			smart_str_free(&ctx->buf);
+		} else {
+			*handled_output = NULL;
+		}
+	} else {
+		*handled_output = NULL;
+	}
 }
 
 int php_url_scanner_add_var(char *name, int name_len, char *value, int value_len, int urlencode TSRMLS_DC)