X-Git-Url: https://git.m6w6.name/?p=m6w6%2Fext-http;a=blobdiff_plain;f=php_http_url.c;h=c5c19a55568bd6fd10ee8f310fb5a247d0e72030;hp=2c5d3f48f86ae719a387335c319776ec59d83803;hb=4bf1b4570329514fa00dc68c6e02f581c3792d73;hpb=8840a33028d28fa4f351b08b7502c1642c758af5

diff --git a/php_http_url.c b/php_http_url.c
index 2c5d3f4..c5c19a5 100644
--- a/php_http_url.c
+++ b/php_http_url.c
@@ -1026,44 +1026,55 @@ static ZEND_RESULT_CODE parse_widn(struct parse_state *state)
 }
 #endif
 
-static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *ptr)
+#ifdef HAVE_INET_PTON
+static const char *parse_ip6(struct parse_state *state, const char *ptr)
 {
 	size_t mb, len;
-	const char *end = state->ptr, *tmp = ptr, *port = NULL;
-
-#ifdef HAVE_INET_PTON
-	if (*ptr == '[') {
-		char *error = NULL, *tmp = memchr(ptr, ']', end - ptr);
-
-		if (tmp) {
-			size_t addrlen = tmp - ptr + 1;
-			char buf[16], *addr = estrndup(ptr + 1, addrlen - 2);
-			int rv = inet_pton(AF_INET6, addr, buf);
-
-			efree(addr);
-			if (rv == 1) {
-				state->buffer[state->offset] = '[';
-				state->url.host = &state->buffer[state->offset];
-				inet_ntop(AF_INET6, buf, state->url.host + 1, state->maxlen - state->offset);
-				state->offset += strlen(state->url.host);
-				state->buffer[state->offset++] = ']';
-				state->buffer[state->offset++] = 0;
-				ptr = tmp + 1;
-			} else if (rv == -1) {
-				error = strerror(errno);
-			} else {
-				error = "unexpected '['";
-			}
+	const char *error = NULL, *end = state->ptr, *tmp = memchr(ptr, ']', end - ptr);
+
+	if (tmp) {
+		size_t addrlen = tmp - ptr + 1;
+		char buf[16], *addr = estrndup(ptr + 1, addrlen - 2);
+		int rv = inet_pton(AF_INET6, addr, buf);
+
+		if (rv == 1) {
+			state->buffer[state->offset] = '[';
+			state->url.host = &state->buffer[state->offset];
+			inet_ntop(AF_INET6, buf, state->url.host + 1, state->maxlen - state->offset);
+			state->offset += strlen(state->url.host);
+			state->buffer[state->offset++] = ']';
+			state->buffer[state->offset++] = 0;
+			ptr = tmp + 1;
+		} else if (rv == -1) {
+			error = strerror(errno);
 		} else {
-			error = "expected ']'";
+			error = "unexpected '['";
 		}
+		efree(addr);
+	} else {
+		error = "expected ']'";
+	}
 
-		if (error) {
-			php_error_docref(NULL, E_WARNING, "Failed to parse hostinfo; %s", error);
-			return FAILURE;
-		}
+	if (error) {
+		php_error_docref(NULL, E_WARNING, "Failed to parse hostinfo; %s", error);
+		return NULL;
 	}
+
+	return ptr;
+}
 #endif
+
+static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *ptr)
+{
+	size_t mb, len;
+	const char *end = state->ptr, *tmp = ptr, *port = NULL, *label = NULL;
+
+#ifdef HAVE_INET_PTON
+	if (*ptr == '[' && !(ptr = parse_ip6(state, ptr))) {
+		return FAILURE;
+	}
+#endif
+
 	if (ptr != end) do {
 		switch (*ptr) {
 		case ':':
@@ -1091,6 +1102,20 @@ static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *pt
 		case '!': case '$': case '&': case '\'': case '(': case ')': case '*':
 		case '+': case ',': case ';': case '=': /* sub-delims */
 		case '-': case '.': case '_': case '~': /* unreserved */
+			if (port || !label) {
+				/* sort of a compromise, just ensure we don't end up
+				 * with a dot at the beginning or two consecutive dots
+				 */
+				php_error_docref(NULL, E_WARNING,
+						"Failed to parse %s; unexpected '%c' at pos %u in '%s'",
+						port ? "port" : "host",
+						(unsigned char) *ptr, (unsigned) (ptr - tmp), tmp);
+				return FAILURE;
+			}
+			state->buffer[state->offset++] = *ptr;
+			label = NULL;
+			break;
+
 		case 'A': case 'B': case 'C': case 'D': case 'E': case 'F': case 'G':
 		case 'H': case 'I': case 'J': case 'K': case 'L': case 'M': case 'N':
 		case 'O': case 'P': case 'Q': case 'R': case 'S': case 'T': case 'U':
@@ -1113,6 +1138,7 @@ static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *pt
 				state->url.port *= 10;
 				state->url.port += *ptr - '0';
 			} else {
+				label = ptr;
 				state->buffer[state->offset++] = *ptr;
 			}
 			break;
@@ -1128,6 +1154,7 @@ static ZEND_RESULT_CODE parse_hostinfo(struct parse_state *state, const char *pt
 			} else if (!(mb = parse_mb(state, PARSE_HOSTINFO, ptr, end, tmp, 0))) {
 				return FAILURE;
 			}
+			label = ptr;
 			ptr += mb - 1;
 		}
 	} while (++ptr != end);
@@ -1290,8 +1317,11 @@ static const char *parse_query(struct parse_state *state)
 			state->buffer[state->offset++] = *state->ptr;
 			break;
 
-		case ']':
-		case '[':
+		/* RFC1738 unsafe */
+		case '{': case '}':
+		case '<': case '>':
+		case '[': case ']':
+		case '|': case '\\': case '^': case '`': case '"': case ' ':
 			if (state->flags & PHP_HTTP_URL_PARSE_TOPCT) {
 				state->buffer[state->offset++] = '%';
 				state->buffer[state->offset++] = parse_xdigits[((unsigned char) *state->ptr) >> 4];
@@ -1362,6 +1392,19 @@ static const char *parse_fragment(struct parse_state *state)
 			state->buffer[state->offset++] = *state->ptr;
 			break;
 
+		/* RFC1738 unsafe */
+		case '{': case '}':
+		case '<': case '>':
+		case '[': case ']':
+		case '|': case '\\': case '^': case '`': case '"': case ' ':
+			if (state->flags & PHP_HTTP_URL_PARSE_TOPCT) {
+				state->buffer[state->offset++] = '%';
+				state->buffer[state->offset++] = parse_xdigits[((unsigned char) *state->ptr) >> 4];
+				state->buffer[state->offset++] = parse_xdigits[((unsigned char) *state->ptr) & 0xf];
+				break;
+			}
+			/* no break */
+
 		case '?': case '/':
 		case '!': case '$': case '&': case '\'': case '(': case ')': case '*':
 		case '+': case ',': case ';': case '=': /* sub-delims */