From 3845e2c145654dd71a93014d2fadd9b9ce133474 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Fri, 23 Jul 2004 02:05:51 +0000 Subject: [PATCH] MFH: Fixed bug #29333 (output_buffering + trans_sess_id can corrupt output) --- ext/standard/url_scanner_ex.c | 25 ++++++++++++++++++++----- ext/standard/url_scanner_ex.re | 25 ++++++++++++++++++++----- 2 files changed, 40 insertions(+), 10 deletions(-) diff --git a/ext/standard/url_scanner_ex.c b/ext/standard/url_scanner_ex.c index 174afb9ad5..8ef4c2e355 100644 --- a/ext/standard/url_scanner_ex.c +++ b/ext/standard/url_scanner_ex.c @@ -987,16 +987,31 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char * { size_t len; - if (BG(url_adapt_state_ex).url_app.len != 0) { - *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC); + if (BG(url_adapt_state_ex).url_app.len != 0) { + *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC); if (sizeof(uint) < sizeof(size_t)) { if (len > UINT_MAX) len = UINT_MAX; } *handled_output_len = len; - } else { - *handled_output = NULL; - } + } else if (BG(url_adapt_state_ex).url_app.len == 0) { + url_adapt_state_ex_t *ctx = &BG(url_adapt_state_ex); + if (ctx->buf.len) { + smart_str_appendl(&ctx->result, ctx->buf.c, ctx->buf.len); + smart_str_appendl(&ctx->result, output, output_len); + + *handled_output = ctx->result.c; + *handled_output_len = ctx->buf.len + output_len; + + ctx->result.c = NULL; + ctx->result.len = 0; + smart_str_free(&ctx->buf); + } else { + *handled_output = NULL; + } + } else { + *handled_output = NULL; + } } int php_url_scanner_add_var(char *name, int name_len, char *value, int value_len, int urlencode TSRMLS_DC) diff --git a/ext/standard/url_scanner_ex.re b/ext/standard/url_scanner_ex.re index a7d688abcb..ec02d5ebb8 100644 --- a/ext/standard/url_scanner_ex.re +++ b/ext/standard/url_scanner_ex.re @@ -416,16 +416,31 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char * { size_t len; - if (BG(url_adapt_state_ex).url_app.len != 0) { - *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC); + if (BG(url_adapt_state_ex).url_app.len != 0) { + *handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC); if (sizeof(uint) < sizeof(size_t)) { if (len > UINT_MAX) len = UINT_MAX; } *handled_output_len = len; - } else { - *handled_output = NULL; - } + } else if (BG(url_adapt_state_ex).url_app.len == 0) { + url_adapt_state_ex_t *ctx = &BG(url_adapt_state_ex); + if (ctx->buf.len) { + smart_str_appendl(&ctx->result, ctx->buf.c, ctx->buf.len); + smart_str_appendl(&ctx->result, output, output_len); + + *handled_output = ctx->result.c; + *handled_output_len = ctx->buf.len + output_len; + + ctx->result.c = NULL; + ctx->result.len = 0; + smart_str_free(&ctx->buf); + } else { + *handled_output = NULL; + } + } else { + *handled_output = NULL; + } } int php_url_scanner_add_var(char *name, int name_len, char *value, int value_len, int urlencode TSRMLS_DC) -- 2.40.0