php-5.3.6-bug-53924.patch

   1 --- PHP_5_3/ext/standard/url.c  2011/02/04 19:22:43     308034
   2 +++ PHP_5_3/ext/standard/url.c  2011/02/04 21:41:15     308035
   3 @@ -180,15 +180,20 @@
   4                 parse_port:
   5                 p = e + 1;
   6                 pp = p;
   7 -
   8 +
   9                 while (pp-p < 6 && isdigit(*pp)) {
  10                         pp++;
  11                 }
  12 -
  13 +
  14                 if (pp-p < 6 && (*pp == '/' || *pp == '\0')) {
  15                         memcpy(port_buf, p, (pp-p));
  16                         port_buf[pp-p] = '\0';
  17                         ret->port = atoi(port_buf);
  18 +                       if (!ret->port && (pp - p) > 0) {
  19 +                               STR_FREE(ret->scheme);
  20 +                               efree(ret);
  21 +                               return NULL;
  22 +                       }
  23                 } else {
  24                         goto just_path;
  25                 }
  26 @@ -267,6 +272,13 @@
  27                                 memcpy(port_buf, p, (e-p));
  28                                 port_buf[e-p] = '\0';
  29                                 ret->port = atoi(port_buf);
  30 +                               if (!ret->port && (e - p)) {
  31 +                                       STR_FREE(ret->scheme);
  32 +                                       STR_FREE(ret->user);
  33 +                                       STR_FREE(ret->pass);
  34 +                                       efree(ret);
  35 +                                       return NULL;
  36 +                               }
  37                         }
  38                         p--;
  39                 }