Commit message: fix bug #73055
CVE: CVE-2016-7398
CWE: CWE-704
Vulnerability description: A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.

Project: ext-http
File: php_http_params.c

PHP_METHOD(HttpParams, __construct)
{
	zval *zcopy, *zparams = NULL, *param_sep = NULL, *arg_sep = NULL, *val_sep = NULL;
	long flags = PHP_HTTP_PARAMS_DEFAULT;
	zend_error_handling zeh;

	php_http_expect(SUCCESS == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|z!/z/z/z/l", &zparams, &param_sep, &arg_sep, &val_sep, &flags), invalid_arg, return);

	zend_replace_error_handling(EH_THROW, php_http_exception_runtime_class_entry, &zeh TSRMLS_CC);
	{
		switch (ZEND_NUM_ARGS()) {
			case 5:
				zend_update_property_long(php_http_params_class_entry, getThis(), ZEND_STRL("flags"), flags TSRMLS_CC);
				/* no break */
			case 4:
				zend_update_property(php_http_params_class_entry, getThis(), ZEND_STRL("val_sep"), val_sep TSRMLS_CC);
				/* no break */
			case 3:
				zend_update_property(php_http_params_class_entry, getThis(), ZEND_STRL("arg_sep"), arg_sep TSRMLS_CC);
				/* no break */
			case 2:
				zend_update_property(php_http_params_class_entry, getThis(), ZEND_STRL("param_sep"), param_sep TSRMLS_CC);
				/* no break */
		}

		if (zparams) {
			switch (Z_TYPE_P(zparams)) {
				case IS_OBJECT:
				case IS_ARRAY:
					zcopy = php_http_zsep(1, IS_ARRAY, zparams);
					zend_update_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), zcopy TSRMLS_CC);
					zval_ptr_dtor(&zcopy);
					break;
				default:
					zcopy = php_http_ztyp(IS_STRING, zparams);
					if (Z_STRLEN_P(zcopy)) {
						php_http_params_opts_t opts = {
							{Z_STRVAL_P(zcopy), Z_STRLEN_P(zcopy)},
							php_http_params_separator_init(zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("param_sep"), 0 TSRMLS_CC) TSRMLS_CC),
							php_http_params_separator_init(zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("arg_sep"), 0 TSRMLS_CC) TSRMLS_CC),
							php_http_params_separator_init(zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("val_sep"), 0 TSRMLS_CC) TSRMLS_CC),
							NULL, flags
						};

						MAKE_STD_ZVAL(zparams);
						array_init(zparams);
						php_http_params_parse(Z_ARRVAL_P(zparams), &opts TSRMLS_CC);
						zend_update_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), zparams TSRMLS_CC);
						zval_ptr_dtor(&zparams);

						php_http_params_separator_free(opts.param);
						php_http_params_separator_free(opts.arg);
						php_http_params_separator_free(opts.val);
					}
					zval_ptr_dtor(&zcopy);
					break;
			}
		} else {
			MAKE_STD_ZVAL(zparams);
			array_init(zparams);
			zend_update_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), zparams TSRMLS_CC);
			zval_ptr_dtor(&zparams);
		}
	}
	zend_restore_error_handling(&zeh TSRMLS_CC);
}

Project: ext-http
File: php_http_params.c

PHP_METHOD(HttpParams, toArray)
{
	zval *zparams;

	if (SUCCESS != zend_parse_parameters_none()) {
		return;
	}
	zparams = zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), 0 TSRMLS_CC);
	RETURN_ZVAL(zparams, 1, 0);
}

Project: ext-http
File: php_http_params.c

PHP_METHOD(HttpParams, toString)
{
	zval **tmp, *zparams, *zpsep, *zasep, *zvsep, *zflags;
	php_http_buffer_t buf;

	zparams = php_http_zsep(1, IS_ARRAY, zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), 0 TSRMLS_CC));
	zflags = php_http_ztyp(IS_LONG, zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("flags"), 0 TSRMLS_CC));

	zpsep = zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("param_sep"), 0 TSRMLS_CC);
	if (Z_TYPE_P(zpsep) == IS_ARRAY && SUCCESS == zend_hash_get_current_data(Z_ARRVAL_P(zpsep), (void *) &tmp)) {
		zpsep = php_http_ztyp(IS_STRING, *tmp);
	} else {
		zpsep = php_http_ztyp(IS_STRING, zpsep);
	}
	zasep = zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("arg_sep"), 0 TSRMLS_CC);
	if (Z_TYPE_P(zasep) == IS_ARRAY && SUCCESS == zend_hash_get_current_data(Z_ARRVAL_P(zasep), (void *) &tmp)) {
		zasep = php_http_ztyp(IS_STRING, *tmp);
	} else {
		zasep = php_http_ztyp(IS_STRING, zasep);
	}
	zvsep = zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("val_sep"), 0 TSRMLS_CC);
	if (Z_TYPE_P(zvsep) == IS_ARRAY && SUCCESS == zend_hash_get_current_data(Z_ARRVAL_P(zvsep), (void *) &tmp)) {
		zvsep = php_http_ztyp(IS_STRING, *tmp);
	} else {
		zvsep = php_http_ztyp(IS_STRING, zvsep);
	}

	php_http_buffer_init(&buf);
	php_http_params_to_string(&buf, Z_ARRVAL_P(zparams), Z_STRVAL_P(zpsep), Z_STRLEN_P(zpsep), Z_STRVAL_P(zasep), Z_STRLEN_P(zasep), Z_STRVAL_P(zvsep), Z_STRLEN_P(zvsep), Z_LVAL_P(zflags) TSRMLS_CC);

	zval_ptr_dtor(&zparams);
	zval_ptr_dtor(&zpsep);
	zval_ptr_dtor(&zasep);
	zval_ptr_dtor(&zvsep);
	zval_ptr_dtor(&zflags);

	RETVAL_PHP_HTTP_BUFFER_VAL(&buf);
}

Project: ext-http
File: php_http_params.c

PHP_METHOD(HttpParams, offsetExists)
{
	char *name_str;
	int name_len;
	zval **zparam, *zparams;

	if (SUCCESS != zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &name_str, &name_len)) {
		return;
	}

	zparams = php_http_ztyp(IS_ARRAY, zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), 0 TSRMLS_CC));

	if (SUCCESS == zend_symtable_find(Z_ARRVAL_P(zparams), name_str, name_len + 1, (void *) &zparam)) {
		RETVAL_BOOL(Z_TYPE_PP(zparam) != IS_NULL);
	} else {
		RETVAL_FALSE;
	}
	zval_ptr_dtor(&zparams);
}

Project: ext-http
File: php_http_params.c

PHP_METHOD(HttpParams, offsetGet)
{
	char *name_str;
	int name_len;
	zval **zparam, *zparams;

	if (SUCCESS != zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &name_str, &name_len)) {
		return;
	}

	zparams = php_http_ztyp(IS_ARRAY, zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), 0 TSRMLS_CC));

	if (SUCCESS == zend_symtable_find(Z_ARRVAL_P(zparams), name_str, name_len + 1, (void *) &zparam)) {
		RETVAL_ZVAL(*zparam, 1, 0);
	}

	zval_ptr_dtor(&zparams);
}

Project: ext-http
File: php_http_params.c

PHP_METHOD(HttpParams, offsetUnset)
{
	char *name_str;
	int name_len;
	zval *zparams;

	if (SUCCESS != zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &name_str, &name_len)) {
		return;
	}

	zparams = php_http_zsep(1, IS_ARRAY, zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), 0 TSRMLS_CC));

	zend_symtable_del(Z_ARRVAL_P(zparams), name_str, name_len + 1);
	zend_update_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), zparams TSRMLS_CC);

	zval_ptr_dtor(&zparams);
}

Project: ext-http
File: php_http_params.c

PHP_METHOD(HttpParams, offsetSet)
{
	zval *nvalue;
	char *name_str;
	int name_len;
	zval **zparam, *zparams;

	if (SUCCESS != zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sz", &name_str, &name_len, &nvalue)) {
		return;
	}

	zparams = php_http_zsep(1, IS_ARRAY, zend_read_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), 0 TSRMLS_CC));

	if (name_len) {
		if (Z_TYPE_P(nvalue) == IS_ARRAY) {
			zval *new_zparam;

			if (SUCCESS == zend_symtable_find(Z_ARRVAL_P(zparams), name_str, name_len + 1, (void *) &zparam)) {
				new_zparam = php_http_zsep(1, IS_ARRAY, *zparam);
				array_join(Z_ARRVAL_P(nvalue), Z_ARRVAL_P(new_zparam), 0, 0);
			} else {
				new_zparam = nvalue;
				Z_ADDREF_P(new_zparam);
			}
			add_assoc_zval_ex(zparams, name_str, name_len + 1, new_zparam);
		} else {
			zval *tmp;

			if (SUCCESS == zend_symtable_find(Z_ARRVAL_P(zparams), name_str, name_len + 1, (void *) &zparam)) {
				tmp = php_http_zsep(1, IS_ARRAY, *zparam);
			} else {
				MAKE_STD_ZVAL(tmp);
				array_init(tmp);
			}

			Z_ADDREF_P(nvalue);
			add_assoc_zval_ex(tmp, ZEND_STRS("value"), nvalue);
			add_assoc_zval_ex(zparams, name_str, name_len + 1, tmp);
		}
	} else {
		zval *tmp = php_http_ztyp(IS_STRING, nvalue), *arr;

		MAKE_STD_ZVAL(arr);
		array_init(arr);
		add_assoc_bool_ex(arr, ZEND_STRS("value"), 1);
		add_assoc_zval_ex(zparams, Z_STRVAL_P(tmp), Z_STRLEN_P(tmp) + 1, arr);
		zval_ptr_dtor(&tmp);
	}

	zend_update_property(php_http_params_class_entry, getThis(), ZEND_STRL("params"), zparams TSRMLS_CC);
	zval_ptr_dtor(&zparams);
}

Project: ext-http
File: php_http_params.c

PHP_MINIT_FUNCTION(http_params)
{
	zend_class_entry ce = {0};

	INIT_NS_CLASS_ENTRY(ce, "http", "Params", php_http_params_methods);
	php_http_params_class_entry = zend_register_internal_class(&ce TSRMLS_CC);
	php_http_params_class_entry->create_object = php_http_params_object_new;
	zend_class_implements(php_http_params_class_entry TSRMLS_CC, 1, zend_ce_arrayaccess);

	zend_declare_class_constant_stringl(php_http_params_class_entry, ZEND_STRL("DEF_PARAM_SEP"), ZEND_STRL(",") TSRMLS_CC);
	zend_declare_class_constant_stringl(php_http_params_class_entry, ZEND_STRL("DEF_ARG_SEP"), ZEND_STRL(";") TSRMLS_CC);
	zend_declare_class_constant_stringl(php_http_params_class_entry, ZEND_STRL("DEF_VAL_SEP"), ZEND_STRL("=") TSRMLS_CC);
	zend_declare_class_constant_stringl(php_http_params_class_entry, ZEND_STRL("COOKIE_PARAM_SEP"), ZEND_STRL("") TSRMLS_CC);

	zend_declare_class_constant_long(php_http_params_class_entry, ZEND_STRL("PARSE_RAW"), PHP_HTTP_PARAMS_RAW TSRMLS_CC);
	zend_declare_class_constant_long(php_http_params_class_entry, ZEND_STRL("PARSE_ESCAPED"), PHP_HTTP_PARAMS_ESCAPED TSRMLS_CC);
	zend_declare_class_constant_long(php_http_params_class_entry, ZEND_STRL("PARSE_URLENCODED"), PHP_HTTP_PARAMS_URLENCODED TSRMLS_CC);
	zend_declare_class_constant_long(php_http_params_class_entry, ZEND_STRL("PARSE_DIMENSION"), PHP_HTTP_PARAMS_DIMENSION TSRMLS_CC);
	zend_declare_class_constant_long(php_http_params_class_entry, ZEND_STRL("PARSE_RFC5987"), PHP_HTTP_PARAMS_RFC5987 TSRMLS_CC);
	zend_declare_class_constant_long(php_http_params_class_entry, ZEND_STRL("PARSE_RFC5988"), PHP_HTTP_PARAMS_RFC5988 TSRMLS_CC);
	zend_declare_class_constant_long(php_http_params_class_entry, ZEND_STRL("PARSE_DEFAULT"), PHP_HTTP_PARAMS_DEFAULT TSRMLS_CC);
	zend_declare_class_constant_long(php_http_params_class_entry, ZEND_STRL("PARSE_QUERY"), PHP_HTTP_PARAMS_QUERY TSRMLS_CC);

	zend_declare_property_null(php_http_params_class_entry, ZEND_STRL("params"), ZEND_ACC_PUBLIC TSRMLS_CC);
	zend_declare_property_stringl(php_http_params_class_entry, ZEND_STRL("param_sep"), ZEND_STRL(","), ZEND_ACC_PUBLIC TSRMLS_CC);
	zend_declare_property_stringl(php_http_params_class_entry, ZEND_STRL("arg_sep"), ZEND_STRL(";"), ZEND_ACC_PUBLIC TSRMLS_CC);
	zend_declare_property_stringl(php_http_params_class_entry, ZEND_STRL("val_sep"), ZEND_STRL("="), ZEND_ACC_PUBLIC TSRMLS_CC);
	zend_declare_property_long(php_http_params_class_entry, ZEND_STRL("flags"), PHP_HTTP_PARAMS_DEFAULT, ZEND_ACC_PUBLIC TSRMLS_CC);

	return SUCCESS;
}

Project: ext-http
File: php_http_params.c

static size_t check_sep(php_http_params_state_t *state, php_http_params_token_t **separators)
{
	php_http_params_token_t **sep = separators;

	if (state->quotes || state->escape) {
		return 0;
	}
	
	if (sep) while (*sep) {
		if (check_str(state->input.str, state->input.len, (*sep)->str, (*sep)->len)) {
			return (*sep)->len;
		}
		++sep;
	}
	return 0;
}

Project: ext-http
File: php_http_params.c

static inline zend_bool check_str(const char *chk_str, size_t chk_len, const char *sep_str, size_t sep_len) {
	return 0 < sep_len && chk_len >= sep_len && *chk_str == *sep_str && !memcmp(chk_str + 1, sep_str + 1, sep_len - 1);
}

Project: ext-http
File: php_http_params.c

php_http_params_opts_t *php_http_params_opts_default_get(php_http_params_opts_t *opts)
{
	if (!opts) {
		opts = emalloc(sizeof(*opts));
	}

	memcpy(opts, &def_opts, sizeof(def_opts));

	return opts;
}

Project: ext-http
File: php_http_params.c

HashTable *php_http_params_parse(HashTable *params, const php_http_params_opts_t *opts TSRMLS_DC)
{
	php_http_params_state_t state = {{NULL,0}, {NULL,0}, {NULL,0}, {NULL,0}, {NULL,NULL,NULL}, 0, 0};

	state.input.str = opts->input.str;
	state.input.len = opts->input.len;

	if (!params) {
		ALLOC_HASHTABLE(params);
		ZEND_INIT_SYMTABLE(params);
	}

	while (state.input.len) {
		if ((opts->flags & PHP_HTTP_PARAMS_RFC5988) && !state.arg.str) {
			if (*state.input.str == '<') {
				state.quotes = 1;
			} else if (*state.input.str == '>') {
				state.quotes = 0;
			}
		} else if (*state.input.str == '"' && !state.escape) {
			state.quotes = !state.quotes;
		} else {
			state.escape = (*state.input.str == '\\');
		}
		
		if (!state.param.str) {
			/* initialize */
			skip_sep(0, &state, opts->param, opts->arg, opts->val TSRMLS_CC);
			state.param.str = state.input.str;
		} else {
			size_t sep_len;
			/* are we at a param separator? */
			if (0 < (sep_len = check_sep(&state, opts->param))) {
				push_param(params, &state, opts TSRMLS_CC);

				skip_sep(sep_len, &state, opts->param, opts->arg, opts->val TSRMLS_CC);

				/* start off with a new param */
				state.param.str = state.input.str;
				state.param.len = 0;
				state.arg.str = NULL;
				state.arg.len = 0;
				state.val.str = NULL;
				state.val.len = 0;

				continue;

			} else
			/* are we at an arg separator? */
			if (0 < (sep_len = check_sep(&state, opts->arg))) {
				push_param(params, &state, opts TSRMLS_CC);

				skip_sep(sep_len, &state, NULL, opts->arg, opts->val TSRMLS_CC);

				/* continue with a new arg */
				state.arg.str = state.input.str;
				state.arg.len = 0;
				state.val.str = NULL;
				state.val.len = 0;

				continue;

			} else
			/* are we at a val separator? */
			if (0 < (sep_len = check_sep(&state, opts->val))) {
				/* only handle separator if we're not already reading in a val */
				if (!state.val.str) {
					push_param(params, &state, opts TSRMLS_CC);

					skip_sep(sep_len, &state, NULL, NULL, opts->val TSRMLS_CC);

					state.val.str = state.input.str;
					state.val.len = 0;

					continue;
				}
			}
		}
		
		if (state.input.len) {
			++state.input.str;
			--state.input.len;
		}
	}
	/* finalize */
	push_param(params, &state, opts TSRMLS_CC);

	return params;
}

Project: ext-http
File: php_http_params.c

void php_http_params_separator_free(php_http_params_token_t **separator)
{
	php_http_params_token_t **sep = separator;
	if (sep) {
		while (*sep) {
			PTR_FREE((*sep)->str);
			efree(*sep);
			++sep;
		}
		efree(separator);
	}
}

Project: ext-http
File: php_http_params.c

php_http_params_token_t **php_http_params_separator_init(zval *zv TSRMLS_DC)
{
	zval **sep;
	HashPosition pos;
	php_http_params_token_t **ret, **tmp;

	if (!zv) {
		return NULL;
	}

	zv = php_http_ztyp(IS_ARRAY, zv);
	ret = ecalloc(zend_hash_num_elements(Z_ARRVAL_P(zv)) + 1, sizeof(*ret));

	tmp = ret;
	FOREACH_VAL(pos, zv, sep) {
		zval *zt = php_http_ztyp(IS_STRING, *sep);

		if (Z_STRLEN_P(zt)) {
			*tmp = emalloc(sizeof(**tmp));
			(*tmp)->str = estrndup(Z_STRVAL_P(zt), (*tmp)->len = Z_STRLEN_P(zt));
			++tmp;
		}
		zval_ptr_dtor(&zt);
	}
	zval_ptr_dtor(&zv);

	*tmp = NULL;
	return ret;
}

Project: ext-http
File: php_http_params.c

php_http_buffer_t *php_http_params_to_string(php_http_buffer_t *buf, HashTable *params, const char *pss, size_t psl, const char *ass, size_t asl, const char *vss, size_t vsl, unsigned flags TSRMLS_DC)
{
	zval **zparam;
	HashPosition pos, pos1;
	php_http_array_hashkey_t key = php_http_array_hashkey_init(0), key1 = php_http_array_hashkey_init(0);
	zend_bool rfc5987 = 0;

	if (!buf) {
		buf = php_http_buffer_init(NULL);
	}

	FOREACH_HASH_KEYVAL(pos, params, key, zparam) {
		zval **zvalue, **zargs;

		if (Z_TYPE_PP(zparam) != IS_ARRAY) {
			zvalue = zparam;
		} else {
			if (SUCCESS != zend_hash_find(Z_ARRVAL_PP(zparam), ZEND_STRS("value"), (void *) &zvalue)) {
				if (SUCCESS != zend_hash_find(Z_ARRVAL_PP(zparam), ZEND_STRS("*rfc5987*"), (void *) &zvalue)) {
					zvalue = zparam;
				} else {
					rfc5987 = 1;
				}
			}
		}

		php_http_array_hashkey_stringify(&key);
		shift_param(buf, key.str, key.len - 1, *zvalue, pss, psl, ass, asl, vss, vsl, flags, rfc5987 TSRMLS_CC);
		php_http_array_hashkey_stringfree(&key);

		if (Z_TYPE_PP(zparam) == IS_ARRAY && SUCCESS != zend_hash_find(Z_ARRVAL_PP(zparam), ZEND_STRS("arguments"), (void *) &zvalue)) {
			if (zvalue == zparam) {
				continue;
			}
			zvalue = zparam;
		}

		if (Z_TYPE_PP(zvalue) == IS_ARRAY) {
			FOREACH_KEYVAL(pos1, *zvalue, key1, zargs) {
				if (zvalue == zparam && key1.type == HASH_KEY_IS_STRING && !strcmp(key1.str, "value")) {
					continue;
				}

				php_http_array_hashkey_stringify(&key1);
				shift_arg(buf, key1.str, key1.len - 1, *zargs, ass, asl, vss, vsl, flags TSRMLS_CC);
				php_http_array_hashkey_stringfree(&key1);
			}
		}
	}

	php_http_buffer_shrink(buf);
	php_http_buffer_fix(buf);

	return buf;
}

Project: ext-http
File: php_http_params.c

static void prepare_dimension(php_http_buffer_t *buf, php_http_buffer_t *keybuf, zval *zvalue, const char *pss, size_t psl, const char *vss, size_t vsl, unsigned flags TSRMLS_DC)
{
	HashTable *ht = HASH_OF(zvalue);
	HashPosition pos;
	php_http_array_hashkey_t key = php_http_array_hashkey_init(0);
	zval **val;
	php_http_buffer_t prefix;

	if (!ht->nApplyCount++) {
		php_http_buffer_init(&prefix);
		php_http_buffer_append(&prefix, keybuf->data, keybuf->used);

		FOREACH_HASH_KEYVAL(pos, ht, key, val) {
			if (key.type == HASH_KEY_IS_STRING && !*key.str) {
				/* only public properties */
				continue;
			}

			php_http_buffer_appends(&prefix, "[");
			if (key.type == HASH_KEY_IS_STRING) {
				php_http_buffer_append(&prefix, key.str, key.len - 1);
			} else {
				php_http_buffer_appendf(&prefix, "%lu", key.num);
			}
			php_http_buffer_appends(&prefix, "]");

			if (Z_TYPE_PP(val) == IS_ARRAY || Z_TYPE_PP(val) == IS_OBJECT) {
				prepare_dimension(buf, &prefix, *val, pss, psl, vss, vsl, flags TSRMLS_CC);
			} else {
				zval *cpy = php_http_ztyp(IS_STRING, *val);

				shift_key(buf, prefix.data, prefix.used, pss, psl, flags TSRMLS_CC);
				shift_val(buf, cpy, vss, vsl, flags TSRMLS_CC);
				zval_ptr_dtor(&cpy);
			}

			php_http_buffer_cut(&prefix, keybuf->used, prefix.used - keybuf->used);
		}
		php_http_buffer_dtor(&prefix);
	}
	--ht->nApplyCount;
}

Project: ext-http
File: php_http_params.c

static inline void prepare_escaped(zval *zv TSRMLS_DC)
{
	if (Z_TYPE_P(zv) == IS_STRING) {
		quote_string(zv, 0 TSRMLS_CC);
	} else {
		zval_dtor(zv);
		ZVAL_EMPTY_STRING(zv);
	}
}

Project: ext-http
File: php_http_params.c

static inline void prepare_key(unsigned flags, char *old_key, size_t old_len, char **new_key, size_t *new_len TSRMLS_DC)
{
	zval zv;

	INIT_PZVAL(&zv);
	ZVAL_STRINGL(&zv, old_key, old_len, 1);

	if (flags & PHP_HTTP_PARAMS_URLENCODED) {
		prepare_urlencoded(&zv TSRMLS_CC);
	}

	if (flags & PHP_HTTP_PARAMS_ESCAPED) {
		if (flags & PHP_HTTP_PARAMS_RFC5988) {
			prepare_rfc5988(&zv TSRMLS_CC);
		} else {
			prepare_escaped(&zv TSRMLS_CC);
		}
	}

	*new_key = Z_STRVAL(zv);
	*new_len = Z_STRLEN(zv);
}

Project: ext-http
File: php_http_params.c

static inline void prepare_rfc5988(zval *zv TSRMLS_DC)
{
	if (Z_TYPE_P(zv) != IS_STRING) {
		zval_dtor(zv);
		ZVAL_EMPTY_STRING(zv);
	}
}

Project: ext-http
File: php_http_params.c

static inline void prepare_urlencoded(zval *zv TSRMLS_DC)
{
	int len;
	char *str =	php_raw_url_encode(Z_STRVAL_P(zv), Z_STRLEN_P(zv), &len);

	zval_dtor(zv);
	ZVAL_STRINGL(zv, str, len, 0);
}

Project: ext-http
File: php_http_params.c

static inline void prepare_value(unsigned flags, zval *zv TSRMLS_DC)
{
	if (flags & PHP_HTTP_PARAMS_URLENCODED) {
		prepare_urlencoded(zv TSRMLS_CC);
	}

	if (flags & PHP_HTTP_PARAMS_ESCAPED) {
		prepare_escaped(zv TSRMLS_CC);
	}
}

Project: ext-http
File: php_http_params.c

static void push_param(HashTable *params, php_http_params_state_t *state, const php_http_params_opts_t *opts TSRMLS_DC)
{
	if (state->val.str) {
		if (!state->current.val) {
			return;
		} else if (0 < (state->val.len = state->input.str - state->val.str)) {
			sanitize_value(opts->flags, state->val.str, state->val.len, *(state->current.val), state->rfc5987 TSRMLS_CC);
		} else {
			ZVAL_EMPTY_STRING(*(state->current.val));
		}
		state->rfc5987 = 0;
	} else if (state->arg.str) {
		if (0 < (state->arg.len = state->input.str - state->arg.str)) {
			zval *val, key;
			zend_bool rfc5987 = 0;

			INIT_PZVAL(&key);
			ZVAL_NULL(&key);
			sanitize_key(opts->flags, state->arg.str, state->arg.len, &key, &rfc5987 TSRMLS_CC);
			state->rfc5987 = rfc5987;
			if (Z_TYPE(key) == IS_STRING && Z_STRLEN(key)) {
				MAKE_STD_ZVAL(val);
				ZVAL_TRUE(val);

				if (rfc5987) {
					zval **rfc;

					if (SUCCESS == zend_hash_find(Z_ARRVAL_PP(state->current.args), ZEND_STRS("*rfc5987*"), (void *) &rfc)) {
						zend_symtable_update(Z_ARRVAL_PP(rfc), Z_STRVAL(key), Z_STRLEN(key) + 1, (void *) &val, sizeof(zval *), (void *) &state->current.val);
					} else {
						zval *tmp;

						MAKE_STD_ZVAL(tmp);
						array_init_size(tmp, 1);
						zend_symtable_update(Z_ARRVAL_P(tmp), Z_STRVAL(key), Z_STRLEN(key) + 1, (void *) &val, sizeof(zval *), (void *) &state->current.val);
						zend_symtable_update(Z_ARRVAL_PP(state->current.args), ZEND_STRS("*rfc5987*"), (void *) &tmp, sizeof(zval *), NULL);
					}
				} else {
					zend_symtable_update(Z_ARRVAL_PP(state->current.args), Z_STRVAL(key), Z_STRLEN(key) + 1, (void *) &val, sizeof(zval *), (void *) &state->current.val);
				}
			}
			zval_dtor(&key);
		}
	} else if (state->param.str) {
		if (0 < (state->param.len = state->input.str - state->param.str)) {
			zval *prm, *arg, *val, *key;
			zend_bool rfc5987 = 0;

			MAKE_STD_ZVAL(key);
			ZVAL_NULL(key);
			if (opts->flags & PHP_HTTP_PARAMS_RFC5988) {
				sanitize_rfc5988(state->param.str, state->param.len, key TSRMLS_CC);
			} else {
				sanitize_key(opts->flags, state->param.str, state->param.len, key, &rfc5987 TSRMLS_CC);
				state->rfc5987 = rfc5987;
			}
			if (Z_TYPE_P(key) != IS_STRING) {
				merge_param(params, key, &state->current.val, &state->current.args TSRMLS_CC);
			} else if (Z_STRLEN_P(key)) {
				MAKE_STD_ZVAL(prm);
				array_init_size(prm, 2);

				MAKE_STD_ZVAL(val);
				if (opts->defval) {
					ZVAL_COPY_VALUE(val, opts->defval);
					zval_copy_ctor(val);
				} else {
					ZVAL_TRUE(val);
				}
				if (rfc5987 && (opts->flags & PHP_HTTP_PARAMS_RFC5987)) {
					zend_hash_update(Z_ARRVAL_P(prm), "*rfc5987*", sizeof("*rfc5987*"), (void *) &val, sizeof(zval *), (void *) &state->current.val);
				} else {
					zend_hash_update(Z_ARRVAL_P(prm), "value", sizeof("value"), (void *) &val, sizeof(zval *), (void *) &state->current.val);
				}

				MAKE_STD_ZVAL(arg);
				array_init_size(arg, 3);
				zend_hash_update(Z_ARRVAL_P(prm), "arguments", sizeof("arguments"), (void *) &arg, sizeof(zval *), (void *) &state->current.args);

				zend_symtable_update(params, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void *) &prm, sizeof(zval *), (void *) &state->current.param);
			}
			zval_ptr_dtor(&key);
		}
	}
}

Project: ext-http
File: php_http_params.c

static inline void quote_string(zval *zv, zend_bool force TSRMLS_DC)
{
	int len = Z_STRLEN_P(zv);

	Z_STRVAL_P(zv) = php_addcslashes(Z_STRVAL_P(zv), Z_STRLEN_P(zv), &Z_STRLEN_P(zv), 1,
			ZEND_STRL("\0..\37\173\\\"") TSRMLS_CC);

	if (force || len != Z_STRLEN_P(zv) || strpbrk(Z_STRVAL_P(zv), "()<>@,;:\"[]?={} ")) {
		zval tmp = *zv;
		int len = Z_STRLEN_P(zv) + 2;
		char *str = emalloc(len + 1);

		str[0] = '"';
		memcpy(&str[1], Z_STRVAL_P(zv), Z_STRLEN_P(zv));
		str[len-1] = '"';
		str[len] = '\0';

		zval_dtor(&tmp);
		ZVAL_STRINGL(zv, str, len, 0);
	}
}

Project: ext-http
File: php_http_params.c

static void sanitize_dimension(zval *zv TSRMLS_DC)
{
	zval *arr = NULL, *tmp = NULL, **cur = NULL;
	char *var = NULL, *ptr = Z_STRVAL_P(zv), *end = Z_STRVAL_P(zv) + Z_STRLEN_P(zv);
	long level = 0;

	MAKE_STD_ZVAL(arr);
	array_init(arr);
	cur = &arr;

	while (ptr < end) {
		if (!var) {
			var = ptr;
		}

		switch (*ptr) {
			case '[':
				if (++level > PG(max_input_nesting_level)) {
					zval_ptr_dtor(&arr);
					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Max input nesting level of %ld exceeded", (long) PG(max_input_nesting_level));
					return;
				}
				if (ptr - var == 0) {
					++var;
					break;
				}
				/* no break */

			case ']':

				MAKE_STD_ZVAL(tmp);
				ZVAL_NULL(tmp);
				convert_to_array(*cur);

				if (ptr - var) {
					char chr = *ptr;
					*ptr = '\0';
					zend_symtable_update(Z_ARRVAL_PP(cur), var, ptr - var + 1, (void *) &tmp, sizeof(zval *), (void *) &cur);
					*ptr = chr;
				} else {
					zend_hash_next_index_insert(Z_ARRVAL_PP(cur), (void *) &tmp, sizeof(zval *), (void *) &cur);
				}

				var = NULL;
				break;
		}

		++ptr;
	}

	if (zend_hash_num_elements(Z_ARRVAL_P(arr))) {
		zval_dtor(zv);
#if PHP_VERSION_ID >= 50400
		ZVAL_COPY_VALUE(zv, arr);
#else
		zv->value = arr->value;
		Z_TYPE_P(zv) = Z_TYPE_P(arr);
#endif
		FREE_ZVAL(arr);
	} else {
		zval_ptr_dtor(&arr);
	}
}

Project: ext-http
File: php_http_params.c

static inline void sanitize_escaped(zval *zv TSRMLS_DC)
{
	if (Z_STRVAL_P(zv)[0] == '"' && Z_STRVAL_P(zv)[Z_STRLEN_P(zv) - 1] == '"') {
		size_t deq_len = Z_STRLEN_P(zv) - 2;
		char *deq = estrndup(Z_STRVAL_P(zv) + 1, deq_len);

		zval_dtor(zv);
		ZVAL_STRINGL(zv, deq, deq_len, 0);
	}

	php_stripcslashes(Z_STRVAL_P(zv), &Z_STRLEN_P(zv));
}

Project: ext-http
File: php_http_params.c

static inline void sanitize_key(unsigned flags, char *str, size_t len, zval *zv, zend_bool *rfc5987 TSRMLS_DC)
{
	char *eos;

	zval_dtor(zv);
	php_trim(str, len, NULL, 0, zv, 3 TSRMLS_CC);

	if (flags & PHP_HTTP_PARAMS_ESCAPED) {
		sanitize_escaped(zv TSRMLS_CC);
	}
	
	if (!Z_STRLEN_P(zv)) {
		return;
	}

	if (flags & PHP_HTTP_PARAMS_RFC5987) {
		eos = &Z_STRVAL_P(zv)[Z_STRLEN_P(zv)-1];
		if (*eos == '*') {
			*eos = '\0';
			*rfc5987 = 1;
			Z_STRLEN_P(zv) -= 1;
		}
	}

	if (flags & PHP_HTTP_PARAMS_URLENCODED) {
		sanitize_urlencoded(zv TSRMLS_CC);
	}

	if (flags & PHP_HTTP_PARAMS_DIMENSION) {
		sanitize_dimension(zv TSRMLS_CC);
	}
}

Project: ext-http
File: php_http_params.c

static inline void sanitize_rfc5987(zval *zv, char **language, zend_bool *latin1 TSRMLS_DC)
{
	char *ptr;

	/* examples:
	 * iso-8850-1'de'bl%f6der%20schei%df%21
	 * utf-8'de-DE'bl%c3%b6der%20schei%c3%9f%21
	 */

	switch (Z_STRVAL_P(zv)[0]) {
	case 'I':
	case 'i':
		if (!strncasecmp(Z_STRVAL_P(zv), "iso-8859-1", lenof("iso-8859-1"))) {
			*latin1 = 1;
			ptr = Z_STRVAL_P(zv) + lenof("iso-8859-1");
			break;
		}
		/* no break */
	case 'U':
	case 'u':
		if (!strncasecmp(Z_STRVAL_P(zv), "utf-8", lenof("utf-8"))) {
			*latin1 = 0;
			ptr = Z_STRVAL_P(zv) + lenof("utf-8");
			break;
		}
		/* no break */
	default:
		return;
	}

	/* extract language */
	if (*ptr == '\'') {
		for (*language = ++ptr; *ptr && *ptr != '\''; ++ptr);
		if (!*ptr) {
			*language = NULL;
			return;
		}
		*language = estrndup(*language, ptr - *language);

		/* remainder */
		ptr = estrdup(++ptr);
		zval_dtor(zv);
		ZVAL_STRING(zv, ptr, 0);
	}
}

Project: ext-http
File: php_http_params.c

static inline void sanitize_rfc5988(char *str, size_t len, zval *zv TSRMLS_DC)
{
	zval_dtor(zv);
	php_trim(str, len, " ><", 3, zv, 3 TSRMLS_CC);
}

Project: ext-http
File: php_http_params.c

static inline void sanitize_urlencoded(zval *zv TSRMLS_DC)
{
	Z_STRLEN_P(zv) = php_raw_url_decode(Z_STRVAL_P(zv), Z_STRLEN_P(zv));
}

Project: ext-http
File: php_http_params.c

static inline void sanitize_value(unsigned flags, char *str, size_t len, zval *zv, zend_bool rfc5987 TSRMLS_DC)
{
	char *language = NULL;
	zend_bool latin1 = 0;

	zval_dtor(zv);
	php_trim(str, len, NULL, 0, zv, 3 TSRMLS_CC);

	if (rfc5987) {
		sanitize_rfc5987(zv, &language, &latin1 TSRMLS_CC);
	}

	if (flags & PHP_HTTP_PARAMS_ESCAPED) {
		sanitize_escaped(zv TSRMLS_CC);
	}

	if ((flags & PHP_HTTP_PARAMS_URLENCODED) || (rfc5987 && language)) {
		sanitize_urlencoded(zv TSRMLS_CC);
	}

	if (rfc5987 && language) {
		zval *tmp;

		if (latin1) {
			utf8encode(zv);
		}

		MAKE_STD_ZVAL(tmp);
		ZVAL_COPY_VALUE(tmp, zv);
		array_init(zv);
		add_assoc_zval(zv, language, tmp);
		PTR_FREE(language);
	}
}

Project: ext-http
File: php_http_params.c

static void shift_arg(php_http_buffer_t *buf, char *key_str, size_t key_len, zval *zvalue, const char *ass, size_t asl, const char *vss, size_t vsl, unsigned flags TSRMLS_DC)
{
	if (Z_TYPE_P(zvalue) == IS_ARRAY || Z_TYPE_P(zvalue) == IS_OBJECT) {
		HashPosition pos;
		php_http_array_hashkey_t key = php_http_array_hashkey_init(0);
		zval **val;
		zend_bool rfc5987 = !strcmp(key_str, "*rfc5987*");

		if (!rfc5987) {
			shift_key(buf, key_str, key_len, ass, asl, flags TSRMLS_CC);
		}
		FOREACH_KEYVAL(pos, zvalue, key, val) {
			/* did you mean recursion? */
			php_http_array_hashkey_stringify(&key);
			if (rfc5987 && (Z_TYPE_PP(val) == IS_ARRAY || Z_TYPE_PP(val) == IS_OBJECT)) {
				shift_key(buf, key.str, key.len-1, ass, asl, flags TSRMLS_CC);
				shift_rfc5987(buf, *val, vss, vsl, flags TSRMLS_CC);
			} else {
				shift_arg(buf, key.str, key.len-1, *val, ass, asl, vss, vsl, flags TSRMLS_CC);
			}
			php_http_array_hashkey_stringfree(&key);
		}
	} else {
		shift_key(buf, key_str, key_len, ass, asl, flags TSRMLS_CC);

		if (flags & PHP_HTTP_PARAMS_RFC5988) {
			switch (key_len) {
			case lenof("rel"):
			case lenof("title"):
			case lenof("anchor"):
				/* some args must be quoted */
				if (0 <= php_http_select_str(key_str, 3, "rel", "title", "anchor")) {
					shift_rfc5988_val(buf, zvalue, vss, vsl, flags TSRMLS_CC);
					return;
				}
				break;
			}
		}

		shift_val(buf, zvalue, vss, vsl, flags TSRMLS_CC);
	}
}

Project: ext-http
File: php_http_params.c

static inline void shift_key(php_http_buffer_t *buf, char *key_str, size_t key_len, const char *ass, size_t asl, unsigned flags TSRMLS_DC)
{
	char *str;
	size_t len;

	if (buf->used) {
		php_http_buffer_append(buf, ass, asl);
	}

	prepare_key(flags, key_str, key_len, &str, &len TSRMLS_CC);
	php_http_buffer_append(buf, str, len);
	efree(str);
}

Project: ext-http
File: php_http_params.c

static void shift_param(php_http_buffer_t *buf, char *key_str, size_t key_len, zval *zvalue, const char *pss, size_t psl, const char *ass, size_t asl, const char *vss, size_t vsl, unsigned flags, zend_bool rfc5987 TSRMLS_DC)
{
	if (Z_TYPE_P(zvalue) == IS_ARRAY || Z_TYPE_P(zvalue) == IS_OBJECT) {
		/* treat as arguments, unless we care for dimensions or rfc5987 */
		if (flags & PHP_HTTP_PARAMS_DIMENSION) {
			php_http_buffer_t *keybuf = php_http_buffer_from_string(key_str, key_len);
			prepare_dimension(buf, keybuf, zvalue, pss, psl, vss, vsl, flags TSRMLS_CC);
			php_http_buffer_free(&keybuf);
		} else if (rfc5987) {
			shift_key(buf, key_str, key_len, pss, psl, flags TSRMLS_CC);
			shift_rfc5987(buf, zvalue, vss, vsl, flags TSRMLS_CC);
		} else {
			shift_arg(buf, key_str, key_len, zvalue, ass, asl, vss, vsl, flags TSRMLS_CC);
		}
	} else {
		if (flags & PHP_HTTP_PARAMS_RFC5988) {
			shift_rfc5988(buf, key_str, key_len, pss, psl, flags TSRMLS_CC);
		} else {
			shift_key(buf, key_str, key_len, pss, psl, flags TSRMLS_CC);
		}
		shift_val(buf, zvalue, vss, vsl, flags TSRMLS_CC);
	}
}

Project: ext-http
File: php_http_params.c

static inline void shift_rfc5987(php_http_buffer_t *buf, zval *zvalue, const char *vss, size_t vsl, unsigned flags TSRMLS_DC)
{
	HashTable *ht = HASH_OF(zvalue);
	zval **zdata, *tmp;
	php_http_array_hashkey_t key = php_http_array_hashkey_init(0);

	if (SUCCESS == zend_hash_get_current_data(ht, (void *) &zdata)
	&&	HASH_KEY_NON_EXISTENT != (key.type = zend_hash_get_current_key_ex(ht, &key.str, &key.len, &key.num, key.dup, NULL))
	) {
		php_http_array_hashkey_stringify(&key);
		php_http_buffer_appendf(buf, "*%.*sutf-8'%.*s'",
				(int) (vsl > INT_MAX ? INT_MAX : vsl), vss,
				(int) (key.len > INT_MAX ? INT_MAX : key.len), key.str);
		php_http_array_hashkey_stringfree(&key);

		tmp = php_http_zsep(1, IS_STRING, *zdata);
		prepare_value(flags | PHP_HTTP_PARAMS_URLENCODED, tmp TSRMLS_CC);
		php_http_buffer_append(buf, Z_STRVAL_P(tmp), Z_STRLEN_P(tmp));
		zval_ptr_dtor(&tmp);
	}
}

Project: ext-http
File: php_http_params.c

static inline void shift_rfc5988(php_http_buffer_t *buf, char *key_str, size_t key_len, const char *ass, size_t asl, unsigned flags TSRMLS_DC)
{
	char *str;
	size_t len;

	if (buf->used) {
		php_http_buffer_append(buf, ass, asl);
	}

	prepare_key(flags, key_str, key_len, &str, &len TSRMLS_CC);
	php_http_buffer_appends(buf, "<");
	php_http_buffer_append(buf, str, len);
	php_http_buffer_appends(buf, ">");
	efree(str);
}

Project: ext-http
File: php_http_params.c

static inline void shift_rfc5988_val(php_http_buffer_t *buf, zval *zv, const char *vss, size_t vsl, unsigned flags TSRMLS_DC)
{
	zval *tmp = php_http_zsep(1, IS_STRING, zv);

	quote_string(tmp, 1 TSRMLS_CC);
	php_http_buffer_append(buf, vss, vsl);
	php_http_buffer_append(buf, Z_STRVAL_P(tmp), Z_STRLEN_P(tmp));

	zval_ptr_dtor(&tmp);
}

Project: ext-http
File: php_http_params.c

static inline void shift_val(php_http_buffer_t *buf, zval *zvalue, const char *vss, size_t vsl, unsigned flags TSRMLS_DC)
{
	if (Z_TYPE_P(zvalue) != IS_BOOL) {
		zval *tmp = php_http_zsep(1, IS_STRING, zvalue);

		prepare_value(flags, tmp TSRMLS_CC);
		php_http_buffer_append(buf, vss, vsl);
		php_http_buffer_append(buf, Z_STRVAL_P(tmp), Z_STRLEN_P(tmp));

		zval_ptr_dtor(&tmp);
	} else if (!Z_BVAL_P(zvalue)) {
		php_http_buffer_append(buf, vss, vsl);
		php_http_buffer_appends(buf, "0");
	}
}

Project: ext-http
File: php_http_params.c

static void skip_sep(size_t skip, php_http_params_state_t *state, php_http_params_token_t **param, php_http_params_token_t **arg, php_http_params_token_t **val TSRMLS_DC)
{
	size_t sep_len;

	state->input.str += skip;
	state->input.len -= skip;

	while (	(param && (sep_len = check_sep(state, param)))
	||		(arg && (sep_len = check_sep(state, arg)))
	||		(val && (sep_len = check_sep(state, val)))
	) {
		state->input.str += sep_len;
		state->input.len -= sep_len;
	}
}

Project: ext-http
File: php_http_params.c

static void utf8encode(zval *zv)
{
	size_t pos, len = 0;
	unsigned char *ptr = (unsigned char *) Z_STRVAL_P(zv);

	while (*ptr) {
		if (*ptr++ >= 0x80) {
			++len;
		}
		++len;
	}

	ptr = safe_emalloc(1, len, 1);
	for (len = 0, pos = 0; len <= Z_STRLEN_P(zv); ++len, ++pos) {
		ptr[pos] = Z_STRVAL_P(zv)[len];
		if ((ptr[pos]) >= 0x80) {
			ptr[pos + 1] = 0x80 | (ptr[pos] & 0x3f);
			ptr[pos] = 0xc0 | ((ptr[pos] >> 6) & 0x1f);
			++pos;
		}
	}
	zval_dtor(zv);
	ZVAL_STRINGL(zv, (char *) ptr, pos-1, 0);
}