From: Zeev Suraski <zeev@php.net>
Date: Fri, 9 Jun 2000 13:15:19 +0000 (+0000)
Subject: Fix #4928
X-Git-Tag: PRE_EIGHT_BYTE_ALLOC_PATCH~10
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=cbd3f41ba8667fbd3e0dcaa82f4d16d1b592f039;p=php

Fix #4928
Be *CAREFUL* with the _ex API, guys!
---

diff --git a/NEWS b/NEWS
index 4a2e6930a2..c40f3d5ce9 100644
--- a/NEWS
+++ b/NEWS
@@ -2,8 +2,11 @@ PHP 4.0                                                                    NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 
 ?? ??? 2000, Version 4.0.1
-- Parse errors in the php.ini files under Windows will no longer mess up the
-  HTTP headers in CGI mode and are now displayed in a message box (Zeev)
+- Fixed a bug in rawurldecode() that would cause in rawurldecode() corrupting
+  its argument (Zeev)
+- Parse errors (or other errors) in the php.ini files under Windows will no
+  longer mess up the HTTP headers in CGI mode and are now displayed in a
+  message box (Zeev)
 - Fixed a crash in OCIFetchStatement() when trying to read after all data
   has already been read. (Thies)
 - fopen_wrappers() are now extensible via modules (Hartmut Holzgraefe)
diff --git a/ext/standard/url.c b/ext/standard/url.c
index c1e7bf7f3b..9b159d8887 100644
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -391,6 +391,7 @@ PHP_FUNCTION(rawurldecode)
 {
 	pval **arg;
 	int len;
+	char *str;
 
 	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &arg) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -400,9 +401,10 @@ PHP_FUNCTION(rawurldecode)
 	if (!(*arg)->value.str.len) {
 		RETURN_FALSE;
 	}
-	len = php_raw_url_decode((*arg)->value.str.val, (*arg)->value.str.len);
+	str = estrndup(Z_STRVAL_PP(arg), Z_STRLEN_PP(arg));
+	len = php_raw_url_decode(str, Z_STRLEN_PP(arg));
 
-	RETVAL_STRINGL((*arg)->value.str.val, len, 1);
+	RETVAL_STRINGL(str, len, 0);
 }
 /* }}} */