Fixed bug #50073 (parse_url() incorrect when ? in fragment).

NEWS

@@ -19,6 +19,7 @@ PHP                                                                        NEWS
   (Felipe)
 - Fixed memory leak in openssl_pkcs12_export_to_file(). (Felipe)
 
+- Fixed bug #50073 (parse_url() incorrect when ? in fragment). (Ilia)
 - Fixed bug #50006 (Segfault caused by uksort()). (Felipe)
 - Fixed bug #49990 (SNMP3 warning message about security level printed twice).
   (Jani)

ext/standard/url.c

@@ -201,10 +201,21 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 	e = ue;
 	
 	if (!(p = memchr(s, '/', (ue - s)))) {
-		if ((p = memchr(s, '?', (ue - s)))) {
-			e = p;
-		} else if ((p = memchr(s, '#', (ue - s)))) {
-			e = p;
+		char *query, *fragment;
+
+		query = memchr(s, '?', (ue - s));
+		fragment = memchr(s, '#', (ue - s));
+
+		if (query && fragment) {
+			if (query > fragment) {
+				p = e = fragment;
+			} else {
+				p = e = query;
+			}
+		} else if (query) {
+			p = e = query;
+		} else if (fragment) {
+			p = e = fragment;
 		}
 	} else {
 		e = p;
@@ -285,10 +296,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 	
 	if ((p = memchr(s, '?', (ue - s)))) {
 		pp = strchr(s, '#');
-		
+
 		if (pp && pp < p) {
 			p = pp;
-			pp = strchr(pp+2, '#');
+			goto label_parse;
 		}
 	
 		if (p - s) {