From d57f9e5ea41aac7e40d37b6335cd2e03bf3b73fa Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Fri, 4 Sep 2020 17:15:35 +0200
Subject: Handle null encoding in mb_http_input()

---
 ext/mbstring/mbstring.c                    | 28 ++++++++++++++++++----------
 ext/mbstring/tests/mb_http_input_pass.phpt | 11 +++++++++++
 2 files changed, 29 insertions(+), 10 deletions(-)

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 24c5550975..050afa26e6 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -1319,6 +1319,7 @@ PHP_FUNCTION(mb_http_input)
 	char *type = NULL;
 	size_t type_len = 0, n;
 	const mbfl_encoding **entry;
+	const mbfl_encoding *encoding;
 
 	ZEND_PARSE_PARAMETERS_START(0, 1)
 		Z_PARAM_OPTIONAL
@@ -1326,34 +1327,34 @@ PHP_FUNCTION(mb_http_input)
 	ZEND_PARSE_PARAMETERS_END();
 
 	if (type == NULL) {
-		RETVAL_STRING(MBSTRG(http_input_identify)->name);
+		encoding = MBSTRG(http_input_identify);
 	} else {
 		switch (*type) {
 		case 'G':
 		case 'g':
-			RETVAL_STRING(MBSTRG(http_input_identify_get)->name);
+			encoding = MBSTRG(http_input_identify_get);
 			break;
 		case 'P':
 		case 'p':
-			RETVAL_STRING(MBSTRG(http_input_identify_post)->name);
+			encoding = MBSTRG(http_input_identify_post);
 			break;
 		case 'C':
 		case 'c':
-			RETVAL_STRING(MBSTRG(http_input_identify_cookie)->name);
+			encoding = MBSTRG(http_input_identify_cookie);
 			break;
 		case 'S':
 		case 's':
-			RETVAL_STRING(MBSTRG(http_input_identify_string)->name);
+			encoding = MBSTRG(http_input_identify_string);
 			break;
 		case 'I':
 		case 'i':
 			entry = MBSTRG(http_input_list);
 			n = MBSTRG(http_input_list_size);
 			array_init(return_value);
-			for (int i = 0; i < n; i++, entry++) {
+			for (size_t i = 0; i < n; i++, entry++) {
 				add_next_index_string(return_value, (*entry)->name);
 			}
-			break;
+			return;
 		case 'L':
 		case 'l':
 			entry = MBSTRG(http_input_list);
@@ -1362,10 +1363,11 @@ PHP_FUNCTION(mb_http_input)
 				// TODO should return empty string?
 				RETURN_FALSE;
 			}
+			// TODO Use smart_str instead.
 			mbfl_string result;
 			mbfl_memory_device device;
 			mbfl_memory_device_init(&device, n * 12, 0);
-			for (int i = 0; i < n; i++, entry++) {
+			for (size_t i = 0; i < n; i++, entry++) {
 				mbfl_memory_device_strcat(&device, (*entry)->name);
 				mbfl_memory_device_output(',', &device);
 			}
@@ -1373,13 +1375,19 @@ PHP_FUNCTION(mb_http_input)
 			mbfl_memory_device_result(&device, &result);
 			RETVAL_STRINGL((const char*)result.val, result.len);
 			mbfl_string_clear(&result);
-			break;
+			return;
 		default:
 			// TODO ValueError
-			RETVAL_STRING(MBSTRG(http_input_identify)->name);
+			encoding = MBSTRG(http_input_identify);
 			break;
 		}
 	}
+
+	if (encoding) {
+		RETURN_STRING(encoding->name);
+	} else {
+		RETURN_FALSE;
+	}
 }
 /* }}} */
 
diff --git a/ext/mbstring/tests/mb_http_input_pass.phpt b/ext/mbstring/tests/mb_http_input_pass.phpt
index ffca4498d7..c04f5ff118 100644
--- a/ext/mbstring/tests/mb_http_input_pass.phpt
+++ b/ext/mbstring/tests/mb_http_input_pass.phpt
@@ -20,6 +20,10 @@ echo $_GET['b']."\n";
 // Get encoding
 var_dump(mb_http_input('P'));
 var_dump(mb_http_input('G'));
+var_dump(mb_http_input('C'));
+var_dump(mb_http_input('S'));
+var_dump(mb_http_input('I'));
+var_dump(mb_http_input('L'));
 
 ?>
 --EXPECT--
@@ -27,3 +31,10 @@ var_dump(mb_http_input('G'));
 日本語0123456789日本語カタカナひらがな
 string(4) "pass"
 string(4) "pass"
+bool(false)
+bool(false)
+array(1) {
+  [0]=>
+  string(4) "pass"
+}
+string(4) "pass"
-- 
cgit v1.2.1