From c3e88c6d59c6a8581b0244de41c533e88cb6c9c4 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Mon, 30 Dec 2002 15:35:55 +0000
Subject: [PATCH] MFH

---
 main/php_variables.c | 43 ++++++++++++++++++++++++++-----------------
 main/rfc1867.c       |  9 ++++++---
 2 files changed, 32 insertions(+), 20 deletions(-)

diff --git a/main/php_variables.c b/main/php_variables.c
index fbf762ee3e..d0283cd44f 100644
--- a/main/php_variables.c
+++ b/main/php_variables.c
@@ -120,7 +120,28 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, pval *track_vars_arra
 
 	while (1) {
 		if (is_array) {
-			char *escaped_index;
+			char *escaped_index = NULL, *index_s;
+			int new_idx_len = 0;
+
+			ip++;
+			index_s = ip;
+			if (isspace(*ip)) {
+				ip++;
+			}
+			if (*ip==']') {
+				index_s = NULL;
+			} else {
+				ip = strchr(ip, ']');
+				if (!ip) {
+					/* PHP variables cannot contain '[' in their names, so we replace the character with a '_' */
+					*(index_s - 1) = '_';
+					index_len = var_len = strlen(var);
+					goto plain_var;
+					return;
+				}
+				*ip = 0;
+				new_idx_len = strlen(index_s);	
+			}
 
 			if (!index) {
 				MAKE_STD_ZVAL(gpc_element);
@@ -148,22 +169,9 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, pval *track_vars_arra
 			}
 			symtable1 = Z_ARRVAL_PP(gpc_element_p);
 			/* ip pointed to the '[' character, now obtain the key */
-			index = ++ip;
-			index_len = 0;
-			if (*ip=='\n' || *ip=='\r' || *ip=='\t' || *ip==' ') {
-				ip++;
-			}
-			if (*ip==']') {
-				index = NULL;
-			} else {
-				ip = strchr(ip, ']');
-				if (!ip) {
-					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Missing ] in %s variable", var);
-					return;
-				}
-				*ip = 0;
-				index_len = strlen(index);
-			}
+			index = index_s;
+			index_len = new_idx_len;
+
 			ip++;
 			if (*ip=='[') {
 				is_array = 1;
@@ -172,6 +180,7 @@ PHPAPI void php_register_variable_ex(char *var, zval *val, pval *track_vars_arra
 				is_array = 0;
 			}
 		} else {
+plain_var:
 			MAKE_STD_ZVAL(gpc_element);
 			gpc_element->value = val->value;
 			Z_TYPE_P(gpc_element) = Z_TYPE_P(val);
diff --git a/main/rfc1867.c b/main/rfc1867.c
index 60dfc2fe78..34977a8e85 100644
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -104,7 +104,7 @@ static void normalize_protected_variable(char *varname TSRMLS_DC)
 
 	/* done? */
 	while (index) {
-		
+
 		while (*index == ' ' || *index == '\r' || *index == '\n' || *index=='\t') {
 			index++;
 		}
@@ -897,8 +897,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 			 * ends in [.*]
 			 * start_arr is set to point to 1st [
 			 */
-			is_arr_upload =	(start_arr = strchr(param,'[')) &&
-							(param[strlen(param)-1] == ']');
+			is_arr_upload =	(start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');
+			/* handle unterminated [ */
+			if (!is_arr_upload && start_arr) {
+				*start_arr = '_';
+			}
 
 			if (is_arr_upload) {
 				array_len = strlen(start_arr);
-- 
2.40.0