fix for bug #69076, fix handling of URLs with lone '?' as last character

diff --git a/php_http_url.c b/php_http_url.c
index 951af23993d0e4bd7415edd5d84786138a2f1e6e..14ad6f7067b6444577571e8046e17e0f7b71979c 100644 (file)
--- a/php_http_url.c
+++ b/php_http_url.c
@@ -1271,7 +1271,7 @@ static const char *parse_query(struct parse_state *state)
        tmp = ++state->ptr;
        state->url.query = &state->buffer[state->offset];
 
-       do {
+       while(state->ptr < state->end) {
                switch (*state->ptr) {
                case '#':
                        goto done;
@@ -1323,7 +1323,9 @@ static const char *parse_query(struct parse_state *state)
                        }
                        state->ptr += mb - 1;
                }
-       } while (++state->ptr < state->end);
+
+               ++state->ptr;
+       }
 
        done:
        state->buffer[state->offset++] = 0;

diff --git a/tests/bug69076.phpt b/tests/bug69076.phpt
new file mode 100644 (file)
index 0000000..cd64958
--- /dev/null
+++ b/tests/bug69076.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #69076 (URL parsing throws exception on empty query string)
+--SKIPIF--
+<?php 
+include "skipif.inc";
+?>
+--FILE--
+<?php 
+echo "Test\n";
+echo new http\Url("http://foo.bar/?");
+?>
+
+===DONE===
+--EXPECT--
+Test
+http://foo.bar/
+===DONE===