Fixed bug #21267 (opening URLs that result in redirection to a relative

path was failing).

1 files changed, 15 insertions, 9 deletions

diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
index 68d7f643ec..5b0471e5ab 100644
--- a/ext/standard/http_fopen_wrapper.c
+++ b/ext/standard/http_fopen_wrapper.c
@@ -339,19 +339,25 @@ php_stream *php_stream_url_wrap_http(php_stream_wrapper *wrapper, char *path, ch
 
 			zval *entry, **entryp;
 			char new_path[HTTP_HEADER_BLOCK_SIZE];
+			char loc_path[HTTP_HEADER_BLOCK_SIZE];
 
 			*new_path='\0';
-			if (strlen(location)<8 || (strncasecmp(location, "http://", 7) && strncasecmp(location, "https://", 8))) {
-				strcpy(new_path, resource->scheme);
-				strlcat(new_path, resource->host, sizeof(new_path));
-				if ((use_ssl && resource->port != 443) || (!use_ssl && resource->port != 80)) {
-					snprintf(new_path+strlen(new_path), sizeof(new_path)-strlen(new_path)-1, ":%d", resource->port);
-				}
+			if (strlen(location)<8 || (strncasecmp(location, "http://", sizeof("http://")-1) && strncasecmp(location, "https://", sizeof("https://")-1))) {
 				if (*location != '/') {
-					php_dirname(resource->path, strlen(resource->path));
-					snprintf (new_path+strlen(new_path), sizeof(new_path)-strlen(new_path)-1, "%s/", resource->path);
+					if (*(location+1) != '\0') {				
+						php_dirname(resource->path, strlen(resource->path));
+						snprintf(loc_path, sizeof(loc_path) - 1, "%s%s", resource->path, location);
+					} else {
+						snprintf(loc_path, sizeof(loc_path) - 1, "/%s", location);
+					}
+				} else {
+					strlcpy(loc_path, location, sizeof(loc_path));
+				}
+				if ((use_ssl && resource->port != 443) || (!use_ssl && resource->port != 80)) {
+					snprintf(new_path, sizeof(new_path) - 1, "%s://%s:%d%s", resource->scheme, resource->host, resource->port, loc_path);
+				} else {
+					snprintf(new_path, sizeof(new_path) - 1, "%s://%s%s", resource->scheme, resource->host, loc_path);
 				}
-				strlcat(new_path, location, sizeof(new_path));
 			}
 			else {
 				strlcpy(new_path, location, sizeof(new_path));