Skip to content

Commit 0fc2bb9

Browse files
author
Ilia Alshanetsky
committed
Fixed bug #26862 (ob_flush() followed by output_reset_rewrite_vars() may
result in data loss).
1 parent 3d4c792 commit 0fc2bb9

File tree

3 files changed

+25
-4
lines changed

3 files changed

+25
-4
lines changed

ext/session/tests/bug26862.phpt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
Bug #26862 (ob_flush() before output_reset_rewrite_vars() results in data loss)
3+
--SKIPIF--
4+
<?php include('skipif.inc'); ?>
5+
--INI--
6+
register_globals=0
7+
html_errors=0
8+
--FILE--
9+
<?php
10+
session_start();
11+
output_add_rewrite_var('var', 'value');
12+
13+
echo '<a href="file.php">link</a>';
14+
15+
ob_flush();
16+
17+
output_reset_rewrite_vars();
18+
echo '<a href="file.php">link</a>';
19+
?>
20+
--EXPECT--
21+
<a href="file.php?var=value">link</a><a href="file.php">link</a>

ext/standard/url_scanner_ex.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
/* Generated by re2c 0.5 on Thu Jan 8 20:25:46 2004 */
2-
#line 1 "/usr/src/web/php/php5/ext/standard/url_scanner_ex.re"
1+
/* Generated by re2c 0.5 on Wed Feb 11 11:58:10 2004 */
2+
#line 1 "/home/rei/php5/ext/standard/url_scanner_ex.re"
33
/*
44
+----------------------------------------------------------------------+
55
| PHP Version 5 |
@@ -918,7 +918,7 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char *
918918
size_t len;
919919

920920
if (BG(url_adapt_state_ex).url_app.len != 0) {
921-
*handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode&PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC);
921+
*handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC);
922922
if (sizeof(uint) < sizeof(size_t)) {
923923
if (len > UINT_MAX)
924924
len = UINT_MAX;

ext/standard/url_scanner_ex.re

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -417,7 +417,7 @@ static void php_url_scanner_output_handler(char *output, uint output_len, char *
417417
size_t len;
418418

419419
if (BG(url_adapt_state_ex).url_app.len != 0) {
420-
*handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode&PHP_OUTPUT_HANDLER_END ? 1 : 0) TSRMLS_CC);
420+
*handled_output = url_adapt_ext(output, output_len, &len, (zend_bool) (mode & (PHP_OUTPUT_HANDLER_END|PHP_OUTPUT_HANDLER_CONT) ? 1 : 0) TSRMLS_CC);
421421
if (sizeof(uint) < sizeof(size_t)) {
422422
if (len > UINT_MAX)
423423
len = UINT_MAX;

0 commit comments

Comments
 (0)