From: Pierrick Charron <pierrick@php.net>
Date: Thu, 7 Jun 2012 15:44:20 +0000 (+0200)
Subject: Fixed bug #51094 (parse_ini_file() with INI_SCANNER_RAW cuts a value that includes... 
X-Git-Tag: php-5.3.15RC1~52
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=fed5923dbc849659321a4f9aa96634ddd1655229;p=php

Fixed bug #51094 (parse_ini_file() with INI_SCANNER_RAW cuts a value that includes a semi-colon)

Modify the scanner to check if the first char of the raw data is an opening " in which case we
need to find the closing one. Otherwise just search for the next end of value char [\r\n;\000]
---

diff --git a/NEWS b/NEWS
index 42eb5b464e..a6b41f4cec 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,10 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2012, PHP 5.3.15
+- Zend Engine:
+  . Fixed bug #51094 (parse_ini_file() with INI_SCANNER_RAW cuts a value that
+    includes a semi-colon). (Pierrick)
+
 - COM:
   . Fixed bug #62146 com_dotnet cannot be built shared. (Johannes)
 
diff --git a/Zend/zend_ini_scanner.l b/Zend/zend_ini_scanner.l
index 0c452e659b..8aeb076eab 100644
--- a/Zend/zend_ini_scanner.l
+++ b/Zend/zend_ini_scanner.l
@@ -347,7 +347,7 @@ DOLLAR_CURLY "${"
 
 SECTION_RAW_CHARS [^\]\n\r]
 SINGLE_QUOTED_CHARS [^']
-RAW_VALUE_CHARS [^\n\r;\000]
+RAW_VALUE_CHARS [^"\n\r;\000]
 
 LITERAL_DOLLAR ("$"([^{\000]|("\\"{ANY_CHAR})))
 VALUE_CHARS         ([^$= \t\n\r;&|~()!"'\000]|{LITERAL_DOLLAR})
@@ -445,12 +445,33 @@ SECTION_VALUE_CHARS ([^$\n\r;"'\]\\]|("\\"{ANY_CHAR})|{LITERAL_DOLLAR})
 	return '=';
 }
 
-<ST_RAW>{RAW_VALUE_CHARS}+ { /* Raw value, only used when SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW. */
-	/* Eat leading and trailing double quotes */
-	if (yytext[0] == '"' && yytext[yyleng - 1] == '"') {
-		SCNG(yy_text)++;
-		yyleng = yyleng - 2;
+<ST_RAW>["] {
+	while (YYCURSOR < YYLIMIT) {
+		switch (*YYCURSOR++) {
+			case '\n':
+				SCNG(lineno)++;
+				break;
+			case '\r':
+				if (*YYCURSOR != '\n') {
+					SCNG(lineno)++;
+				}
+				break;
+			case '"':
+				yyleng = YYCURSOR - SCNG(yy_text) - 2;
+				SCNG(yy_text)++;
+				RETURN_TOKEN(TC_RAW, yytext, yyleng);
+			case '\\':
+				if (YYCURSOR < YYLIMIT) {
+					YYCURSOR++;
+				}
+				break;
+		}
 	}
+	yyleng = YYCURSOR - SCNG(yy_text);
+	RETURN_TOKEN(TC_RAW, yytext, yyleng);
+}
+
+<ST_RAW>{RAW_VALUE_CHARS}+ { /* Raw value, only used when SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW. */
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
 
diff --git a/ext/standard/tests/file/bug51094.phpt b/ext/standard/tests/file/bug51094.phpt
new file mode 100644
index 0000000000..7823558722
--- /dev/null
+++ b/ext/standard/tests/file/bug51094.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Fixed bug #51094 (parse_ini_file() with INI_SCANNER_RAW cuts a value that includes a semi-colon).
+--FILE--
+<?php
+
+$ini = parse_ini_string('ini="ini;raw"', null, INI_SCANNER_RAW);
+var_dump($ini['ini']);
+$ini = parse_ini_string('ini="ini;raw', null, INI_SCANNER_RAW);
+var_dump($ini['ini']);
+$ini = parse_ini_string('ini=ini;raw', null, INI_SCANNER_RAW);
+var_dump($ini['ini']);
+$ini = parse_ini_string('ini=ini"raw', null, INI_SCANNER_RAW);
+var_dump($ini['ini']);
+$ini = parse_ini_string("ini=\r\niniraw", null, INI_SCANNER_RAW);
+var_dump($ini['ini']);
+--EXPECTF--
+string(7) "ini;raw"
+string(8) ""ini;raw"
+string(3) "ini"
+string(7) "ini"raw"
+string(0) ""
+