From 860f294514633abead8ed6df000655a93e98a30c Mon Sep 17 00:00:00 2001
From: Boris Madzar <boris.madzar@mixedreturns.com>
Date: Sun, 22 Mar 2015 00:54:12 -0400
Subject: [PATCH] fix for bug #69076, fix handling of URLs with lone '?' as
 last character

---
 php_http_url.c      |  6 ++++--
 tests/bug69076.phpt | 17 +++++++++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 tests/bug69076.phpt

diff --git a/php_http_url.c b/php_http_url.c
index 951af23..14ad6f7 100644
--- a/php_http_url.c
+++ b/php_http_url.c
@@ -1271,7 +1271,7 @@ static const char *parse_query(struct parse_state *state)
 	tmp = ++state->ptr;
 	state->url.query = &state->buffer[state->offset];
 
-	do {
+	while(state->ptr < state->end) {
 		switch (*state->ptr) {
 		case '#':
 			goto done;
@@ -1323,7 +1323,9 @@ static const char *parse_query(struct parse_state *state)
 			}
 			state->ptr += mb - 1;
 		}
-	} while (++state->ptr < state->end);
+
+		++state->ptr;
+	}
 
 	done:
 	state->buffer[state->offset++] = 0;
diff --git a/tests/bug69076.phpt b/tests/bug69076.phpt
new file mode 100644
index 0000000..cd64958
--- /dev/null
+++ b/tests/bug69076.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #69076 (URL parsing throws exception on empty query string)
+--SKIPIF--
+<?php 
+include "skipif.inc";
+?>
+--FILE--
+<?php 
+echo "Test\n";
+echo new http\Url("http://foo.bar/?");
+?>
+
+===DONE===
+--EXPECT--
+Test
+http://foo.bar/
+===DONE===
-- 
2.30.2